Low risk browser extensions

Cuponeria sends shopping-site extension page views to Google Analytics with a persistent extension UUID.

Daily Weather Forecast sends visited site domains to apicdn.co and uses its responses to redirect matching link clicks.

DesktopHut Live Wallpapers Tab Pro sends bookmark domains to third-party favicon services on the new-tab page.

Dictionariez lets visited pages send supplied text to pnl.dev through its translation bridge.

Directors Desk SecureView bridges document links on directorsdesk.com to a local native viewer, forwarding a hardcoded key seed bundled in the extension.

Doodle Jump allows notifications from digitalgamedoo.com and opens that site when installed.

Dragon Ball Super: Broly Wallpaper sends your most-visited site URLs to Google's favicon service on each new-tab page.

Enhanced Outlook Web App loads its popup and settings stylesheets from cdnjs.cloudflare.com.

FUNiX Passport sends exact page URLs to funix-onpage-translator.web.app for hostnames in a remotely refreshed list.

IG Follower Export Tool logs Instagram challenge and suspended-page URLs with persistent identifiers to Aliyun Log Service.

Format Copier sends Chrome profile email, weekly IP geolocation, and Gmail feedback content to its backend.

G-Switch 3 Unblocked samples its game page's cookie and storage metadata and sends it to Poki.

GfG to GitHub uploads solved GeeksforGeeks problem pages and solution code to the user's linked GitHub repository.

Global Privacy Control (GPC) Inspector records request URLs and Cookie headers for every HTTP(S) tab in memory.

HBO Max Party sends Max viewing, account, and profile data to remote collection endpoints.

ILGMS Drafting Helper Plugin lets any website page overwrite saved certificate issuer details.

JSON Formatter Pro loads Google-hosted fonts when its popup opens.

Jarvis sends the Chrome profile email address to Google Analytics during install and telemetry events.

KPop Demon Hunters Cursor adds an extension-specific DOM marker to every matched website.

Kitty for Google Chrome sends a persistent extension UID to cursorcats.com during install and update pages.

METJET Free Bulk Messaging lets WhatsApp Web page scripts read its chrome.storage.local data.

Magnet extension sends Yahoo Store Creator page HTML to ec-magnet.com during error logging.

Minecraft Nature sends each saved new-tab shortcut URL to Google's favicon service.

N-bot - Google Meet Online class Attender sends joined Meet URLs and saved meeting timetables to nithins.me.

OmniDefend SSO Extension accepts forged postMessage tokens without origin validation, allowing any web page to read the Windows username when Windows autologin is configured.

Open Access Helper Web reads article DOI values from pages and sends them to open-access lookup APIs.

OshiKoi sends the active page URL to its chat API during system-trigger greeting messages.

PAN AUTO помощник для Encar sends contact form details and selected vehicle context to PAN AUTO's API.

Pinnable ChatGPT accepts auth details from the page URL and renders the supplied email inside the ChatGPT sidebar.

Pinterest Image Downloader | Futoo sends full page URLs and page-view details from every site to Google Analytics.

Podio Super Menu sends Podio identifiers to bettersupermenu.com and includes a hardcoded backend password.

Postmann contacts api.country.is to infer your country from your IP address when its popup opens.

Productor for KDP sends KDP book metadata to Productor trademark APIs when users run trademark checks.

Project Plans editor reports each new tab event to OffiDocs with a persistent extension-local username.

Radio Station-to-Station Ext requests the Radio Browser server list over cleartext HTTP when its popup opens.

Readlax sends the active page hostname to Google's favicon service when reader mode renders the page.

Reverse Image Search opens Google reverse-image searches over HTTP with the selected image URL in the query string.

SEO Render Insight Tool loads a Google Fonts stylesheet into pages when its minimap is enabled.

SEO | ASO | Search Ranking & Keyword Tool sends the active tab URL and title to Google Analytics when opened.

SKLive聊天表情插件 posts Twitch channel panel HTML to sk-knower.com.

Search by Image & Price Tracker for eBay sends each page's URL, title, and referrer to Google Analytics.

Send from Gmail opens a new tab to a URL returned by gmplus.io when the extension is installed.

Share and attach files in Gmail by cloudHQ sends Gmail account-switcher email addresses to cloudHQ.

Shopify Analyzer lets any website display the stored IXSPY account email in the page.

ShotApp lets any site trigger active-tab screenshot capture and stores the page URL and image locally.

Site Site Blocker exposes a short extension identifier in the page DOM on every site it runs on.

SiteData sends Google search keywords and result domains to SiteData traffic APIs.

Spark SEO by seoClarity lets any web page trigger seoClarity API requests for the current tab URL with the stored token.

Spider Man Wallpaper sends your most-visited site URLs to Google's favicon service on its new-tab page.

Spider-Man: Across the Spider Verse Wallpaper sends top-site URLs from its new-tab page to Google's favicon service.

Stat4Market sends a shared hardcoded API auth token with its background requests to Stat4Market servers.

TeachShare Copilot sends visited page URLs and titles to TeachShare for educational-content classification.

TheGuarantors - Chrome Extension sends building-list requests to theguarantors.com with a bundled API key.

Thinlabs Kiosk writes device MAC address and internal network topology into localStorage on every page the browser visits.

Tool EOP sends EOP task questions, answers, course identifiers, and image URLs to Tool EOP backends.

TuneFinder writes a persistent identifier into HTTP cookies for tunefinderapp.com during installation.

URL Auto Redirector redirects some matching HTTPS pages to HTTP versions using its enabled default rules.

UnInternet loads a remote Font Awesome stylesheet from cdnjs when its popup opens.

VK Saver automatically sends a page-load beacon from VK and aferon.com pages to aferon.com/stat.

Varia Integrator forwards download and active-tab URLs to a local aria2 JSON-RPC service.