Low risk browser extensions

Influencer Hero adds a stable extension user ID to its analytics iframe on supported social profile pages.

Internet Security by MetaCert sends visited URLs and Gmail links to MetaCert and puts blocked URLs in a redirect.

Last.fm Scrobbler for YouTube embeds a Last.fm API secret and uses it to sign Last.fm account and scrobble requests.

Luffy Zoro Epic Duo in One Piece Live Wallpaper renders Gameograf-supplied HTML inside its new tab page.

Meltwater Extension lets any website open its extension page and send your active tab URL to Meltwater APIs.

MercadoLibre Herramientas con IA lets any website request fee estimates using stored MercadoLibre user IDs.

Multi-Agent Link Converter Plugin by OGNews redirects shopping product pages to selected agent affiliate URLs.

NetHunt CRM for Gmail adds the logged-in email and user ID to its Chrome uninstall URL.

New Lantern sends hardware, window, and page telemetry to Datadog while study or report pages are open.

Olhar Digital Ofertas collects configured checkout page values and sends them to ofertas.olhardigital.com.br.

OneAI Extension lets any visited page trigger authenticated image uploads and OCR/edit workflows.

Push Notifications Blocker lets page scripts trigger its injected UI to allow notifications for the current site.

QweTab lets any website ask the extension to open page-chosen tabs, windows, or incognito windows.

Recipes New Tab requests random recipe results from api.spoonacular.com using a hardcoded API key.

Rex KeepAlive sends encrypted session heartbeat reports with IP address, geolocation, and device fingerprint to Rex.

Right Click Opens Link New Tab lets page-dispatched mouse events open attacker-chosen URLs in new tabs.

SEO-tools sends the active tab URL and domain to SEO, QR, WHOIS, and IP lookup services when its popup opens.

Sakuga Extended runs JavaScript embedded in Sakugabooru comment script tags when post pages load.

Search & Link Preview lets same-origin page scripts open arbitrary URLs in a preview iframe with frame protections removed.

Sendblue Call lets any webpage open attacker-chosen tabs through its injected event bridge.

Shot Crop loads replacement favicons from placehold.co when users change a site's tab color.

ShotApp lets any site trigger active-tab screenshot capture and stores the page URL and image locally.

SideAll modifies DeepSeek response headers so DeepSeek pages can be framed with fewer browser protections.

Snow Rider 3D loads its Unity game configuration and framework from jsDelivr inside a sandboxed popup.

Steamify - Faceit stats checker sends a bundled FACEIT API bearer token with its FACEIT profile and match lookups.

Stranger Things sends your precise location to weather and geocoding APIs after you allow browser location access.

Testing Daily opens install/update tabs from remote ad configuration and sends click telemetry with a generated user ID.

Translate Mi can use remote settings to intercept links on any site and redirect matching navigation.

Twitter Follower sends the signed-in Chrome profile email to api.twitter-follower.com for license checks.

VIT Vellore Library's injected domain-rules script accepts window messages from any frame without checking their origin.

Volt Extension checks a device fingerprint with api.webtvmedia.net and can clear game storage after a ban response.

XPage新标签页 sends promotion search keywords and device/account identifiers to XPage for promotion-enabled accounts.

ZonGuru identifies its user to Mixpanel when its Amazon content script loads on Amazon pages.

Вернуть 1080 и 1440 на Twitch redirects Twitch HLS playlist requests to app.clifl.com with the original query string.

Lean Library ships a hardcoded API Bearer token in its source and collects the user's IP address at startup for institution detection.

EditThisCookie2 loads Google Analytics JavaScript in its privileged background page.

Click and Read extracts scholarly identifiers from web pages and sends them to configured resolver services.

Channel Blocker loads Google Fonts stylesheets from its extension pages when those pages open.

ChatGPT in Sidebar loads remote stylesheets from Cloudflare CDN and jsDelivr when its options page opens.

WebChatGPT inserts sponsored results into Google search pages and reports displayed ad references to api.phtracker.com.

Enhancer lets Twitch and Kick page scripts request its saved settings and watchtime through a page bridge.

0xio Wallet lets any website request unlocked wallet identity and balances through its injected provider.

3D Rolling Ball Game can send Unity game session and device telemetry to api.uca.cloud when its game page opens.

8x8 Work Meetings for Google Chrome loads Google Fonts on supported calendar pages.

AdBlocker for Twitch sends a behavior-based score and a persistent ID to data.adfilterhub.com on pages you visit.

Alive Tab lets remote preferences replace the new-tab search handler and redirect search terms to a selected URL.

Allworx Interact Sync relays extension messaging to all web pages, allowing any site to trigger native phone calls through the local Allworx dialer application.

Art Tab sends precise location coordinates to OpenWeatherMap and top-site hostnames to Google for new-tab widgets.

AutoAds captures Shopee page network traffic and uploads saved product research data to Firebase.

AskGo sends a hashed browser fingerprint to its notification service while you are logged in.

Auto Clicker - AutoFill [BETA] lets allowed external pages read or overwrite its local extension storage.

Auto Leetify Faceit Match Importer sends Faceit demo download URLs to Leetify for match imports.

Background Color Post rewrites the Origin header on Facebook web requests.

Bankybee sends each visited HTTP(S) site hostname to its domain lookup API.

Better Naifu YouTube Gaming loads remote emote catalogs that can insert unescaped image HTML into YouTube live chat.

Blockchair scans web pages for crypto addresses and inserts Blockchair links that load its favicon.

Brawl Stars Wallpaper sends your top Chrome sites to Google's favicon service on its new-tab page.

CFCA CertEnrollment.CZCB Extension bridges web pages on czcb.com.cn to a local native PKI application using caller-supplied host names.

Canvas GPA Calculator checks every visited site for a Canvas API endpoint before saving the first Canvas domain it finds.

Chat GPT Extension loads Font Awesome CSS from cdnjs.cloudflare.com when its popup opens.