Low risk browser extensions

OneAI Extension lets any visited page trigger authenticated image uploads and OCR/edit workflows.

Push Notifications Blocker lets page scripts trigger its injected UI to allow notifications for the current site.

QweTab lets any website ask the extension to open page-chosen tabs, windows, or incognito windows.

Recipes New Tab requests random recipe results from api.spoonacular.com using a hardcoded API key.

Right Click Opens Link New Tab lets page-dispatched mouse events open attacker-chosen URLs in new tabs.

SEO-tools sends the active tab URL and domain to SEO, QR, WHOIS, and IP lookup services when its popup opens.

Sakuga Extended runs JavaScript embedded in Sakugabooru comment script tags when post pages load.

Screenshot with URL - Full Page Screenshot captures page screenshots, URL/title details, optional logs, and local screen recordings.

Search & Link Preview lets same-origin page scripts open arbitrary URLs in a preview iframe with frame protections removed.

SideAll modifies DeepSeek response headers so DeepSeek pages can be framed with fewer browser protections.

Snow Rider 3D loads its Unity game configuration and framework from jsDelivr inside a sandboxed popup.

Steamify - Faceit stats checker sends a bundled FACEIT API bearer token with its FACEIT profile and match lookups.

Stranger Things sends your precise location to weather and geocoding APIs after you allow browser location access.

Testing Daily opens install/update tabs from remote ad configuration and sends click telemetry with a generated user ID.

Translate Mi can use remote settings to intercept links on any site and redirect matching navigation.

Twitter Follower sends the signed-in Chrome profile email to api.twitter-follower.com for license checks.

Volt Extension checks a device fingerprint with api.webtvmedia.net and can clear game storage after a ban response.

WA聊单宝 sends WhatsApp Web page and login metadata to Google Analytics.

Webnovel Translator by OpenNovel posts scraped novel metadata to novellist.co when the user runs a Novellist import.

XPage新标签页 sends promotion search keywords and device/account identifiers to XPage for promotion-enabled accounts.

ZonGuru identifies its user to Mixpanel when its Amazon content script loads on Amazon pages.

Temp Mail loads Google Fonts from its popup when you open the extension UI.

Channel Blocker loads Google Fonts stylesheets from its extension pages when those pages open.

EditThisCookie2 loads Google Analytics JavaScript in its privileged background page.

Lean Library ships a hardcoded API Bearer token in its source and collects the user's IP address at startup for institution detection.

Volume Booster requests Google Fonts when its popup opens, sharing connection metadata with Google.

WebChatGPT inserts sponsored results into Google search pages and reports displayed ad references to api.phtracker.com.

ReviewMeta.com Review Helper sends Bodybuilding product-page identifiers from tab navigations to reviewmeta.com.

0xio Wallet lets any website request unlocked wallet identity and balances through its injected provider.

3D Rolling Ball Game can send Unity game session and device telemetry to api.uca.cloud when its game page opens.

8x8 Work Meetings for Google Chrome loads Google Fonts on supported calendar pages.

Alive Tab lets remote preferences replace the new-tab search handler and redirect search terms to a selected URL.

Allworx Interact Sync relays extension messaging to all web pages, allowing any site to trigger native phone calls through the local Allworx dialer application.

Art Tab sends precise location coordinates to OpenWeatherMap and top-site hostnames to Google for new-tab widgets.

AskGo sends a hashed browser fingerprint to its notification service while you are logged in.

Auto Clicker - AutoFill [BETA] lets allowed external pages read or overwrite its local extension storage.

Auto Leetify Faceit Match Importer sends Faceit demo download URLs to Leetify for match imports.

Background Color Post rewrites the Origin header on Facebook web requests.

Bankybee sends each visited HTTP(S) site hostname to its domain lookup API.

Better Naifu YouTube Gaming loads remote emote catalogs that can insert unescaped image HTML into YouTube live chat.

Blockchair scans web pages for crypto addresses and inserts Blockchair links that load its favicon.

Brawl Stars Wallpaper sends your top Chrome sites to Google's favicon service on its new-tab page.

CFCA CertEnrollment.CZCB Extension bridges web pages on czcb.com.cn to a local native PKI application using caller-supplied host names.

Canvas GPA Calculator checks every visited site for a Canvas API endpoint before saving the first Canvas domain it finds.

Chat GPT Extension loads Font Awesome CSS from cdnjs.cloudflare.com when its popup opens.

Claude to PDF, Word and Google Docs reads your Chrome profile email on install and sends it with a generated ID to Thinksolv.

Copy as Plain Text lets webpages update its paid license state through a page-dispatched Paddle event.

Cristiano Ronaldo Wallpaper sends top-site URLs from its new-tab page to Google's favicon service.

Dark Mode for Chrome exposes a page-visible DOM marker that websites can use to detect the extension.

Docutracks Signer exposes a native signing bridge on all pages, letting any page script trigger a signing operation via a CustomEvent.

Dolby Voice 1.1 relays web page postMessages to a native messaging host with no origin or payload sanitization.

ESB Window Positioner lets localhost web pages read display details and move matching Chrome tabs into fullscreen windows.

Emoji Swap injects jsDelivr-hosted emoji font URLs into every HTTP and HTTPS page it runs on.

Faircado lets any HTTPS page forward messages to the extension, including storage changes and Mixpanel events.

Forbole X lets localhost pages send an external reset message that clears the extension's wallet storage.

Free VPN for Chrome connects through hardcoded proxy services and disables other proxy-capable extensions.

FuseBase PRO lets any webpage replace the Nimbus session header used for later cloud uploads.

GoodPlan sends a generated FingerprintJS visitor ID to its referral endpoint during first-run setup.

Google search results shortcuts posts its extension ID into Google search result pages when its content script starts.

Hilton ResSmart Click to Dial loads third-party Font Awesome CSS on matched call-center pages.