Low risk browser extensions

PureVPN supplies decrypted VPN credentials in response to HTTP authentication challenges from any host, not only its own proxy servers.

Shows HTTP status codes, redirects, headers, and server IP details for pages you visit.

Set password for your browser stores the browser lock password in plaintext in Chrome's local extension storage.

Slido sends signed-in user profile details to Exponea CRM analytics.

Speech to Text downloads Whisper AI model files from huggingface.co without integrity verification.

Support for Read&Write Desktop loads remote scripts from toolbar.speechstream.net into visited pages and connects to a local WebSocket for text-to-speech playback.

TickerIQ Crypto Price Ticker sends periodic heartbeat events to Google Analytics with a persistent per-user identifier.

TxtAnalyser sends the Google Docs document URL, pseudonymized user email, and device metadata to Google Analytics on each interaction.

Reddit Enhancement Suite inserts its version and browser extension ID into Reddit pages.

Read Aloud sends the active tab URL and error details to its vendor server when a text-to-speech playback error occurs.

3Dconnexion extension for Google Chrome opens an unauthenticated local WebSocket that reveals bookmarks and opens URLs on command.

All-In-One Adblocker sends blocked-page domains and Google search visit timestamps to a remote-configured metrics endpoint.

Block Site adds a detectable extension-specific DOM marker to every top-level page it visits.

Compare responses from multiple AI chatbots side by side in your browser.

FACEIT FORECAST sends FACEIT page category and a stored extension device ID to api.fforecast.net.

FastForward lets any website ask its content script to query or submit crowd-bypass URL records.

I still don't care about cookies writes consent cookies that enable analytics or advertising categories on selected sites.

Live Server Web Extension opens live-reload WebSockets from pages when the feature is enabled.

Replaces the new tab page with live wallpapers, speed dials, weather, to-dos, clocks, and meditation features.

MightyText exposes notification settings to any website that embeds its web-accessible helper page.

Open SEO Stats sends the active tab's host and SEO history to history.openadmintools.com when the popup opens.

TickTick - Todo & Task List runs a content script on every page and lets certain page messages close the current tab.

Vencord Web removes Discord Content-Security-Policy headers on Discord page and frame loads.

Feedly's mini widget accepts postMessage commands from any origin whose string merely contains "feedly.com".

Coupert collects all open tab URLs on install and silently accepts cookie consent banners on shopping sites to enable affiliate tracking.

FireShot sends a persistent GUID and extension metadata to the local vendor app at startup and crash reports to screenshot-program.com.

Violentmonkey bundles a hardcoded Google OAuth client_secret that is transmitted to Google's token endpoint during Drive sync.

React Developer Tools posts its stored DevTools settings into every page where its hook runs.

YouTube High Definition sets video quality on YouTube pages and broadcasts the extension's runtime ID via window.postMessage on each load.

DeepL transmits account identifiers and an installation UUID to a third-party A/B testing service on startup.

Tab Session Manager bundles a hardcoded Google OAuth client_secret used to authenticate its Google Drive cloud-sync feature.

VPN routes all browser traffic through vendor proxy servers using hardcoded shared credentials embedded in the extension bundle.

Maps Assist sets Yahoo as the default search engine with embedded affiliate codes that route revenue to the publisher on every search.

Consent-O-Matic fetches unsigned remote rule lists that drive automatic clicks across websites.

Surfshark VPN Extension sends each visited domain to ext.surfshark.com and logs user events with a persistent device ID to ux.surfshark.com.

LeechBlock NG trusts lb-custom pages to complete block-page delay or password flows for chosen sites.

FrankerFaceZ exposes its settings store to YouTube pages via an unguarded externally_connectable message handler.

Dashlane stores and autofills credentials across websites and sends device fingerprint data to a third-party analytics service at startup.

Improve YouTube! modifies the YouTube interface and sends optional requests to googleapis.com using a bundled default API key for public video and channel metadata lookups.

Analytics Debugger sends DevTools panel usage events and browser/platform details to Google Analytics.

Any.do lets web pages create synced tasks through its web-accessible add-task iframe.

Auto Quality for YouTube shares saved quality and auto-pause settings with page scripts through document events.

Better History reads and manages Chrome history locally, with network use limited to icons and user feedback.

Bulk Image Downloader lets page scripts trigger an all-tabs image scan across open HTTP(S) tabs.

CheerpJ Applet Runner exposes a proxy frame that fetches caller-supplied URLs and returns the responses.

Control Panel for YouTube exposes its stored settings to scripts running on YouTube pages.

Copytables runs on every page and writes selected table content to the clipboard.

Enable Copy injects scripts on enabled sites to restore copying and marks the page with its extension ID.

GRABLEY sends eBay order and tracking page HTML to Grabley logs after tracking parse failures in remote debug mode.

Galaxy Ad Blocker accepts remote site scriptlets that can change cookies, DOM state, and fetch/XHR responses.

Grabbit lets webpages trigger right-drag link selection and open attacker-chosen URLs in new tabs.

Highlight This fetches ad rules from HighlightThis and rewrites matching links on pages for ad-license users.

IBM Cognos TM1 Web Clipboard Extension lets any website read and overwrite your clipboard with no origin check.

Inist Plugin For Chrome bridges Russian banking websites to a locally installed native host application via native messaging.

JSON Viewer renders URL values from JSON pages into link attributes without escaping the URL.

Link Redirect Trace sends the current tab's redirect-chain URLs to LinkResearchTools for SEO metrics.

Lumin reports PDF opening telemetry and device details to AWS Pinpoint when it opens PDFs in its viewer.

Mobile View Switcher stores its configured User-Agent in each visited site's localStorage when enabled.

Notta captures browser-tab or meeting audio for transcription and sends it to Notta and AWS servers.

Pacman Popup loads Google-hosted font stylesheets when its game popup opens.