Low risk browser extensions

Dragon Web Extension accepts cross-origin messages on all pages, allowing any window to trigger synthetic clicks on page elements.

Muzli sends each top-visited site URL to Google's favicon service and reports usage telemetry to Google Analytics on every new tab open.

Picture in Picture - floating video player lets users watch videos in a floating window and injects a phantom pageview into the host page's Google Analytics queue on activation.

Work with Salesforce records, tasks, and engagement alerts from Gmail or alongside web pages.

Support for Read&Write Desktop loads remote scripts from toolbar.speechstream.net into visited pages and connects to a local WebSocket for text-to-speech playback.

TickerIQ Crypto Price Ticker sends periodic heartbeat events to Google Analytics with a persistent per-user identifier.

Zoom Video injects a content script on every page to resize and reformat video elements using local controls only.

The extension sends its name and version number to csser.top on every Bilibili page visit via a hidden iframe.

LanguageTool transmits typed text and webmail recipient details to its own API servers during grammar checks.

This extension lets you annotate webpages, PDFs, and EPUBs for notes, research, and discussion.

I still don't care about cookies writes consent cookies that enable analytics or advertising categories on selected sites.

Online PDF Editor (pdf2go.com) uploads Gmail attachment content to pdf2go.com cloud servers when a user clicks the in-Gmail compression button.

Popup Blocker (strict)'s notification page accepts messages from any site, letting it be tricked into redirecting your tab to an attacker's URL.

PureVPN supplies decrypted VPN credentials in response to HTTP authentication challenges from any host, not only its own proxy servers.

Shows HTTP status codes, redirects, headers, and server IP details for pages you visit.

Set password for your browser stores the browser lock password in plaintext in Chrome's local extension storage.

Slido sends signed-in user profile details to Exponea CRM analytics.

Speech to Text downloads Whisper AI model files from huggingface.co without integrity verification.

Vencord Web removes Discord Content-Security-Policy headers on Discord page and frame loads.

Reddit Enhancement Suite inserts its version and browser extension ID into Reddit pages.

Read Aloud sends the active tab URL and error details to its vendor server when a text-to-speech playback error occurs.

Coupert collects all open tab URLs on install and silently accepts cookie consent banners on shopping sites to enable affiliate tracking.

3Dconnexion extension for Google Chrome opens an unauthenticated local WebSocket that reveals bookmarks and opens URLs on command.

AliPrice Sourcing Tool uploads product page data from 1688 and other marketplaces to index.aiprice.com automatically.

All-In-One Adblocker sends blocked-page domains and Google search visit timestamps to a remote-configured metrics endpoint.

Manage crypto assets and connect to Web3 dApps from Chrome.

Block Site adds a detectable extension-specific DOM marker to every top-level page it visits.

Compare responses from multiple AI chatbots side by side in your browser.

FACEIT FORECAST sends FACEIT page category and a stored extension device ID to api.fforecast.net.

FastForward lets any website ask its content script to query or submit crowd-bypass URL records.

Live Server Web Extension opens live-reload WebSockets from pages when the feature is enabled.

Replaces the new tab page with live wallpapers, speed dials, weather, to-dos, clocks, and meditation features.

MightyText exposes notification settings to any website that embeds its web-accessible helper page.

Open SEO Stats sends the active tab's host and SEO history to history.openadmintools.com when the popup opens.

Spoof Geolocation exposes stored spoof-location settings to scripts running on every HTTP or HTTPS page.

Synology Image Assistant Extension exposes a native-messaging file-upload bridge to any web page via an unguarded postMessage handler.

TickTick - Todo & Task List runs a content script on every page and lets certain page messages close the current tab.

Twitch Channel Points Auto Clicker loads a remote ravenbtw.com badge image in some Twitch chat messages.

Feedly's mini widget accepts postMessage commands from any origin whose string merely contains "feedly.com".

Violentmonkey bundles a hardcoded Google OAuth client_secret that is transmitted to Google's token endpoint during Drive sync.

FireShot sends a persistent GUID and extension metadata to the local vendor app at startup and crash reports to screenshot-program.com.

Tab Session Manager bundles a hardcoded Google OAuth client_secret used to authenticate its Google Drive cloud-sync feature.

YouTube High Definition sets video quality on YouTube pages and broadcasts the extension's runtime ID via window.postMessage on each load.

React Developer Tools posts its stored DevTools settings into every page where its hook runs.

VPN routes all browser traffic through vendor proxy servers using hardcoded shared credentials embedded in the extension bundle.

DeepL transmits account identifiers and an installation UUID to a third-party A/B testing service on startup.

Consent-O-Matic fetches unsigned remote rule lists that drive automatic clicks across websites.

Maps Assist sets Yahoo as the default search engine with embedded affiliate codes that route revenue to the publisher on every search.

Surfshark VPN Extension sends each visited domain to ext.surfshark.com and logs user events with a persistent device ID to ux.surfshark.com.

Pinterest Save Button lets webpages trigger visual-search uploads of page images to Pinterest.

LeechBlock NG trusts lb-custom pages to complete block-page delay or password flows for chosen sites.

Dashlane stores and autofills credentials across websites and sends device fingerprint data to a third-party analytics service at startup.

Hide Youtube-Shorts loads Google Fonts when its extension popup opens.

FrankerFaceZ exposes its settings store to YouTube pages via an unguarded externally_connectable message handler.

Improve YouTube! modifies the YouTube interface and sends optional requests to googleapis.com using a bundled default API key for public video and channel metadata lookups.