Low risk browser extensions

RECEPTIONIST Chrome Extension adds installed extension names and versions to Sentry error-reporting context.

Rewards Auto Search reports high automated-search counts and a persistent extension token to its backend.

SADocumentExtension relays arbitrary CustomEvent payloads from any web page to the native host sa.document.extension with no filtering.

SIU Library collects search terms and subscribed e-resource browsing URLs for MyLOFT analytics.

Seismic sends visited page URLs to integrations.knowledge.seismic.com when knowledge triggers are enabled.

Shopping Assistant sends shopping page details to joinsafedeal.com and checks visited domains with reputation services.

SquarespaceWebsites Tools PRO lets allowed Squarespace and Squarewebsites pages read cached site export data.

Star Wars Weather sends visited-site hostnames to Google and precise location to OpenWeather for new-tab features.

Stash lets localhost:3000 pages read open tabs, bookmarks, and stored Stash data through its message bridge.

Twitch Stats by Streams Charts embeds a signing secret used for its StreamsCharts API authorization tokens.

Strongbox AutoFill accepts postMessage commands from any web origin to fill credentials into forms or open new browser tabs.

Tab Wheel Scroll listens for wheel gestures on pages and switches the active tab when matching events occur.

The Amazon ASIN Checker sends browsing data and account email to api.asincheckr.com and injects the server's HTML response into the page.

TrustPlugin relays page messages to a native PKI host without origin validation, exposing certificate enumeration and signing to any site.

Turbo.net Extension forwards every browser navigation URL to a locally installed Turbo.net sandman process via WebSocket.

UBC Workday Side by Side Calendar copies MyWorkday cookies into browser request header rules.

UiPath downloads and executes JavaScript code supplied by a local native host in both its background page and every web page visited.

Vocal reports some API errors to Sentry with request options that can include Authorization bearer headers.

Website Translator sends selected page text to Google Translate and opens whole-page translations with the current URL.

Yandex.Music Extension exposes its Chrome runtime ID to Yandex Music pages through a DOM attribute.

YogaPoseTutorial embeds a Spoonacular API key in its new-tab recipe helper.

YouTube Deleted Videos: Track and Restore stores playlist backups in YouTube page localStorage.

YourAIScroll sends account email addresses to www.youraiscroll.com to check subscription status.

shikicinema exposes hardcoded Kodik, Shikimori, and Smarthard API credentials in a web-accessible bundle.

wildberries track & history stores Wildberries bearer-style site tokens in Chrome sync storage.

The extension sends selected page text to games.onlinetechbd.com when its context-menu search is used.

常用工具(ToolBox) loads remote stylesheet files from p1.chenapp.com when its popup opens.

Adaware AdBlock sends install, update, and daily browser environment telemetry to flow.lavasoft.com.

Torrent Control lets any web page send a magnet URI to the user's configured BitTorrent client.

Spoof Geolocation exposes stored spoofed location settings to any website and accepts unchecked location updates on its setup page.

Temp Mail loads Google Fonts from its popup when you open the extension UI.

AI Translation accepts page messages in its translation panel and sends text, page URLs, context, and extension IDs to its API.

Ad Skipper for Pluto TV [QVI] sends Pluto account, profile, bookmark, and continue-watching data to metricmuse.xyz.

Amazon Ad Tag Helper helps advertisers debug Amazon Ad Tag events and attributes on websites.

Audio Booster for Netflix [QVI] collects streaming profiles and viewing history and uploads results to me3x.online.

Automation Anywhere bridges browser activity to a locally installed RPA agent and forwards external web page messages to native host 'aa.browser.shim' without payload validation.

BBB Vote Counter automatically clicks Globo vote-again buttons after successful vote submissions.

BBViewer lets any page trigger a hidden liquid8d.dev iframe that receives the current page URL.

BestSuggest sends page titles, URLs, headings, and meta keywords to its recommendations API on each completed page load.

Blooket Hacker stores matched quiz question and answer text from active pages in Chrome Sync storage.

CloudTalk Click-to-Call lets webpages trigger its inserted phone links to send click-to-call requests to CloudTalk.

Cluing reports page URLs, titles, and reading engagement metrics for visible text blocks to account.cluing.io.

Codes Hunter sends Roblox game activity, copied codes, searches, and a persistent client ID to Google Analytics.

Contador de Seguidores sends selected Instagram account details to Invertexto endpoints.

Cryplex AI Storage Node lets any website set its stored auth token and trigger node sync to app.cryplex.ai.

Dark Mode lets any page trigger extension-powered fetches for CSS and image URLs.

The extension relays postMessage payloads from any HTTPS page to the com.dynamics.vca native app without validating the sender's origin.

Display Email Time by cloudHQ posts your Gmail account addresses to cloudHQ on each Gmail page load.

Facebook Ad Video Downloader & Ad Data Export lets any webpage trigger its logout and storage reset handler.

Fast Image Research lets any website open reverse-image-search tabs after its optional JavaScript API is enabled.

Give as you Live Donation Reminder sends embedded Basic API credentials to Give as you Live API endpoints.

Global Privacy Control (GPC) Inspector records request URLs and Cookie headers for every HTTP(S) tab in memory.

Goby lets pages set their wallet session origin and use permissions granted to another site.

Gopher Grades posts the user's UMN internet ID to embedded umn.lol course grade iframes.

Grow Bot sends stored SellerAider settings to a Discord webhook when Vinted storage writes hit quota errors.

Hello Kitty Cursor injects an extension-identifying class into pages where it runs.

Highlight Emails in Gmail by cloudHQ sends signed-in Gmail account addresses to www.cloudhq.net during Gmail startup.

Hudl Multi Screen adds page controls whose DOM IDs include its extension runtime ID on Hudl video pages.

Hyper Bold stores each visited page URL and hostname in local browser storage.

IPTV / HLS player / 7000+ free channels exposes a player page that loads caller-supplied HLS URLs.