Low risk browser extensions

Copy as Plain Text lets webpages update its paid license state through a page-dispatched Paddle event.

Cristiano Ronaldo Wallpaper sends top-site URLs from its new-tab page to Google's favicon service.

Dark Mode for Chrome exposes a page-visible DOM marker that websites can use to detect the extension.

Docutracks Signer exposes a native signing bridge on all pages, letting any page script trigger a signing operation via a CustomEvent.

Dolby Voice 1.1 relays web page postMessages to a native messaging host with no origin or payload sanitization.

ESB Window Positioner lets localhost web pages read display details and move matching Chrome tabs into fullscreen windows.

Emoji Swap injects jsDelivr-hosted emoji font URLs into every HTTP and HTTPS page it runs on.

Faircado lets any HTTPS page forward messages to the extension, including storage changes and Mixpanel events.

Forbole X lets localhost pages send an external reset message that clears the extension's wallet storage.

Free VPN for Chrome connects through hardcoded proxy services and disables other proxy-capable extensions.

FuseBase PRO lets any webpage replace the Nimbus session header used for later cloud uploads.

GoodPlan sends a generated FingerprintJS visitor ID to its referral endpoint during first-run setup.

Google search results shortcuts posts its extension ID into Google search result pages when its content script starts.

Hilton ResSmart Click to Dial loads third-party Font Awesome CSS on matched call-center pages.

JSX Preview loads preview-engine libraries from esm.sh and can add Tailwind's CDN while rendering JSX.

Lionel Messi MeaVana sends all-site content-script error telemetry to Glitchtip and account identifiers to PostHog.

Lister by Hustle Got Real sends signed-in users' active tab URLs to Hustle Got Real on navigation.

More Than 10 Shortcuts sends shortcut domains you enter to Google's favicon service.

Motorwatch - car price tracker sends vehicle marketplace search parameters to Google Analytics with a persistent client ID.

Nabox Wallet sends Twitter/X and Telegram profile identifiers to its Nabox ID lookup service during page navigation.

Onlinesim Access fetches proxy settings over plaintext HTTP and applies them to OnlineSim domains.

OpenLink Structured Data Sniffer accepts OIDC auth messages from any origin and stores them in extension storage.

Peek Pop: Link Preview lets embedded frames request and receive the top page's full URL.

PriceTip uses remote configuration to redirect matched page clicks through a Pedanto URL.

Raiz Rewards Browser Extension lets any website trigger a Raiz session API request through its content-script bridge.

Reeader imports a Google Fonts stylesheet when you activate its reader view on a page.

Sardoche-SardAlert checks YouTube video IDs with api.sardoche.tv and can route enabled Pandora traffic through its proxy.

Snake Classic sends its popup page title, popup URL, and extension analytics identifier to Google Analytics.

Spaces loads remote stylesheets from BootstrapCDN and Google Fonts when its extension UI is opened.

Stylus Pressure bridges drawing stylus pressure data from Magma and Dessine web pages to a locally-installed native plugin via native messaging.

Tab Rename Wiz caches each visited page's URL, title, domain, path, and meta description in local browser storage.

Tracker Blocker installs email-tracker blocking rules fetched from GMass.

Turn off sleep mode lets any HTTPS page trigger its keep-awake toggle through the injected sidebar.

Video to mp3 injects a page-accessible relay that lets any website open the extension's conversion tab.

WA Web Translate embeds your WhatsApp phone number in its uninstall URL and in telemetry sent to its vendor's servers.

WA聊单宝 sends WhatsApp Web page and login metadata to Google Analytics.

Walles.AI lets any webpage trigger its Notion memo-sync bridge to send saved memo data to Notion.

Wordler loads Bootstrap CSS from cdn.jsdelivr.net when its popup or options page opens.

Zelix loads Google Fonts when its popup or side panel opens.

ZeratoR includes a fallback Google API key for a YouTube live-status check that its bundled channel list does not use.

ignore-x-frame-options removes X-Frame-Options and Content-Security-Policy headers from every page and frame response.

nextpage sends each visited HTTP or HTTPS page URL to nextpage.episage.com with a persistent extension token.

v2ex plus sends V2EX topic contents and liked replies to vdaily.huguotao.com when vDaily is enabled.

GIPHY for Firefox sends popup GIF interaction telemetry to Giphy with a per-session tracking identifier.

ReviewMeta.com Review Helper sends Bodybuilding product-page identifiers from tab navigations to reviewmeta.com.

迅雷下载支持 forwards download URLs, referrers, and cookies from matching pages and downloads to the Xunlei native host.

FACEIT FORECAST can route FACEIT player and match API lookups through fforecast with a persistent device ID.

TopCashback UK Browser Extension sends shopping-page DOM snapshots to api.onsleek.ai during coupon detection.

Auto Youtube Shorts Scroller loads Font Awesome stylesheets from cdnjs on its extension pages.

Yoroi sends matched browsing URLs with wallet addresses to api.bringweb3.io.

Milanote Web Clipper lets allowed web pages request Milanote account state through its background bridge.

Minimal Theme for X / Twitter sends clicked Twitter/X draft text and reply URLs to Typefully.

Rutracker Torrent Search routes rutracker.org pages through proxy servers loaded from remote server lists.

PrimeCinema creates a persistent tracking cookie and sends it to its website during installation.

Free VPN USA - Planet VPN Proxy decrypts remote proxy credentials using a key embedded in the extension.

VKSaver sends VK page URLs and VK account IDs to dl1.audiovk.com when reporting errors.

Midnight Lizard proxies blocked stylesheet URLs through its background page and exposes the returned CSS in the page DOM.

Dark Mode - Night Eye lets any website trigger support messages sent with stored chat identity details.

AI Chat Exporter preloads Google Fonts on supported AI chat sites, sending page-load request data to fonts.googleapis.com.

AI Homework Helper - Apex Vision AI sends selected text, cropped screenshots, and chat or file prompts to Apex Vision APIs.