Low risk browser extensions

TickerIQ Crypto Price Ticker sends periodic heartbeat events to Google Analytics with a persistent per-user identifier.

Zoom Video injects a content script on every page to resize and reformat video elements using local controls only.

The extension sends its name and version number to csser.top on every Bilibili page visit via a hidden iframe.

LanguageTool transmits typed text and webmail recipient details to its own API servers during grammar checks.

Reddit Enhancement Suite inserts its version and browser extension ID into Reddit pages.

Dragon Web Extension accepts cross-origin messages on all pages, allowing any window to trigger synthetic clicks on page elements.

This extension lets you annotate webpages, PDFs, and EPUBs for notes, research, and discussion.

Online PDF Editor (pdf2go.com) uploads Gmail attachment content to pdf2go.com cloud servers when a user clicks the in-Gmail compression button.

PureVPN supplies decrypted VPN credentials in response to HTTP authentication challenges from any host, not only its own proxy servers.

Shows HTTP status codes, redirects, headers, and server IP details for pages you visit.

Set password for your browser stores the browser lock password in plaintext in Chrome's local extension storage.

Slido sends signed-in user profile details to Exponea CRM analytics.

Speech to Text downloads Whisper AI model files from huggingface.co without integrity verification.

TxtAnalyser sends the Google Docs document URL, pseudonymized user email, and device metadata to Google Analytics on each interaction.

Read Aloud sends the active tab URL and error details to its vendor server when a text-to-speech playback error occurs.

3Dconnexion extension for Google Chrome opens an unauthenticated local WebSocket that reveals bookmarks and opens URLs on command.

All-In-One Adblocker sends blocked-page domains and Google search visit timestamps to a remote-configured metrics endpoint.

Manage crypto assets and connect to Web3 dApps from Chrome.

Block Site adds a detectable extension-specific DOM marker to every top-level page it visits.

Compare responses from multiple AI chatbots side by side in your browser.

FACEIT FORECAST sends FACEIT page category and a stored extension device ID to api.fforecast.net.

FastForward lets any website ask its content script to query or submit crowd-bypass URL records.

I still don't care about cookies writes consent cookies that enable analytics or advertising categories on selected sites.

Live Server Web Extension opens live-reload WebSockets from pages when the feature is enabled.

Replaces the new tab page with live wallpapers, speed dials, weather, to-dos, clocks, and meditation features.

MightyText exposes notification settings to any website that embeds its web-accessible helper page.

Open SEO Stats sends the active tab's host and SEO history to history.openadmintools.com when the popup opens.

QR Code (Generator and Reader) sends generated QR content to short-link services and online decode requests to qrcd.org.

TickTick - Todo & Task List runs a content script on every page and lets certain page messages close the current tab.

Twitch Channel Points Auto Clicker loads a remote ravenbtw.com badge image in some Twitch chat messages.

Vencord Web removes Discord Content-Security-Policy headers on Discord page and frame loads.

Feedly's mini widget accepts postMessage commands from any origin whose string merely contains "feedly.com".

Coupert collects all open tab URLs on install and silently accepts cookie consent banners on shopping sites to enable affiliate tracking.

Violentmonkey bundles a hardcoded Google OAuth client_secret that is transmitted to Google's token endpoint during Drive sync.

FireShot sends a persistent GUID and extension metadata to the local vendor app at startup and crash reports to screenshot-program.com.

React Developer Tools posts its stored DevTools settings into every page where its hook runs.

Tab Session Manager bundles a hardcoded Google OAuth client_secret used to authenticate its Google Drive cloud-sync feature.

YouTube High Definition sets video quality on YouTube pages and broadcasts the extension's runtime ID via window.postMessage on each load.

DeepL transmits account identifiers and an installation UUID to a third-party A/B testing service on startup.

VPN routes all browser traffic through vendor proxy servers using hardcoded shared credentials embedded in the extension bundle.

Consent-O-Matic fetches unsigned remote rule lists that drive automatic clicks across websites.

Maps Assist sets Yahoo as the default search engine with embedded affiliate codes that route revenue to the publisher on every search.

Surfshark VPN Extension sends each visited domain to ext.surfshark.com and logs user events with a persistent device ID to ux.surfshark.com.

LeechBlock NG trusts lb-custom pages to complete block-page delay or password flows for chosen sites.

Dashlane stores and autofills credentials across websites and sends device fingerprint data to a third-party analytics service at startup.

FrankerFaceZ exposes its settings store to YouTube pages via an unguarded externally_connectable message handler.

Hide Youtube-Shorts loads Google Fonts when its extension popup opens.

Improve YouTube! modifies the YouTube interface and sends optional requests to googleapis.com using a bundled default API key for public video and channel metadata lookups.

Analytics Debugger sends DevTools panel usage events and browser/platform details to Google Analytics.

Any.do lets web pages create synced tasks through its web-accessible add-task iframe.

Auto Quality for YouTube shares saved quality and auto-pause settings with page scripts through document events.

Better History reads and manages Chrome history locally, with network use limited to icons and user feedback.

Bulk Image Downloader lets page scripts trigger an all-tabs image scan across open HTTP(S) tabs.

Calculator app sends popup usage and license-flow events to Google Analytics.

Capsule Hub reads your AI chat transcripts and Gmail/Outlook email threads and uploads them to its own servers to build reusable "capsules."

CheerpJ Applet Runner exposes a proxy frame that fetches caller-supplied URLs and returns the responses.