Low risk browser extensions

ANEF Status Tracker uploads ANEF dossier metadata to a Supabase community statistics endpoint by default.

Shield AdBlocker fetches a remote Google Sheets list and redirects matching browsing destinations through affiliate links.

Address Finder for Rightmove sends resolved property addresses and a stored user ID to a Supabase analytics endpoint.

AiPrice(AliPrice) Search by Image for AE Beta accepts spoofed webpage messages that can make it open attacker-chosen URLs.

Anime Girl Night Coffee Break Live Wallpaper fetches popup HTML from api.gameograf.com and inserts it into its new-tab page.

Anime Girl Wallpaper New Tab sends shortcut URLs to Google and adds an affiliate tag to Amazon navigations.

Anime Nook lets remote admincontrol.io settings choose where new-tab search queries are sent.

Avaya Cloud Office for Google lets allowed web pages queue click-to-dial or text actions through a broad message bridge.

Better Blackboard Learn sends discovered Blackboard course IDs to calbaptist.blackboard.com.

Better Classroom loads Google Fonts when the extension popup opens.

Better Roblox Badges lets page scripts start TranslateSub tab-audio capture after its content script is injected.

Better Roblox Badges sends Roblox profile IDs to api.jmk.gg and inserts returned badge names into Roblox pages as HTML.

BewlyBewly! Ave Mujica rewrites Origin and Referer headers on third-party POST requests to Bilibili API hosts.

Bookmarker by start.me accepts external messages that can navigate the active tab or open caller-provided URLs.

Boost Volume - Increase Volume Booster sends matching shopping and YouTube page URLs and titles to Google Analytics.

CFCA CertEnrollment.YZW Extension bridges web pages to local native messaging hosts using a caller-supplied host name with no allowlist.

CFCA CryptoKit.YZW Extension accepts a caller-supplied native messaging host name, allowing any whitelisted page to connect to any native application on the user's machine.

CNFans Warm Reminder Remover rewrites shopping product URLs on CNFans, Mulebuy, and Hoobuy to add referral codes.

CWS: Chinese Dictionary + Pinyin Annotator lets matched pages ask the extension to write page-supplied text to the clipboard.

Canvas Assistant sends full page URLs from non-Canvas pages to its analytics endpoint.

Chartnote removes Content-Security-Policy headers from every top-level site you visit.

Clarie sends your approximate location to its weather service when the new tab page loads.

Cristiano Ronaldo - Cristiano Ronaldo HD wallpaper sends precise location coordinates to OpenWeatherMap for new-tab weather.

Cuponeria sends shopping-site extension page views to Google Analytics with a persistent extension UUID.

Password Boss WebApp sends page-load and navigation telemetry from visited websites to sentry.passwordboss.com.

Daily Weather Forecast sends visited site domains to apicdn.co and uses its responses to redirect matching link clicks.

DesktopHut Live Wallpapers Tab Pro sends bookmark domains to third-party favicon services on the new-tab page.

Dictionariez lets visited pages send supplied text to pnl.dev through its translation bridge.

Directors Desk SecureView bridges document links on directorsdesk.com to a local native viewer, forwarding a hardcoded key seed bundled in the extension.

Doodle Jump allows notifications from digitalgamedoo.com and opens that site when installed.

Dragon Ball Super: Broly Wallpaper sends your most-visited site URLs to Google's favicon service on each new-tab page.

Enhanced Outlook Web App loads its popup and settings stylesheets from cdnjs.cloudflare.com.

FUNiX Passport sends exact page URLs to funix-onpage-translator.web.app for hostnames in a remotely refreshed list.

FluentU sends Netflix and YouTube subtitle text to www.fluentu.com for its language-learning features.

IG Follower Export Tool logs Instagram challenge and suspended-page URLs with persistent identifiers to Aliyun Log Service.

Format Copier sends Chrome profile email, weekly IP geolocation, and Gmail feedback content to its backend.

G-Switch 3 Unblocked samples its game page's cookie and storage metadata and sends it to Poki.

GfG to GitHub uploads solved GeeksforGeeks problem pages and solution code to the user's linked GitHub repository.

GoTo for Google Chrome exposes its extension presence by injecting a chrome-extension popover iframe on pages.

HBO Max Party sends Max viewing, account, and profile data to remote collection endpoints.

ILGMS Drafting Helper Plugin lets any website page overwrite saved certificate issuer details.

JSON Formatter Pro loads Google-hosted fonts when its popup opens.

Jarvis sends the Chrome profile email address to Google Analytics during install and telemetry events.

KPop Demon Hunters Cursor adds an extension-specific DOM marker to every matched website.

Kitty for Google Chrome sends a persistent extension UID to cursorcats.com during install and update pages.

METJET Free Bulk Messaging lets WhatsApp Web page scripts read its chrome.storage.local data.

Magnet extension sends Yahoo Store Creator page HTML to ec-magnet.com during error logging.

Minecraft Nature sends each saved new-tab shortcut URL to Google's favicon service.

N-bot - Google Meet Online class Attender sends joined Meet URLs and saved meeting timetables to nithins.me.

OmniDefend SSO Extension accepts forged postMessage tokens without origin validation, allowing any web page to read the Windows username when Windows autologin is configured.

TikTok Dễ Ẹc sends viewed TikTok shop-video URLs to resolver APIs when unlocking unavailable videos.

Open Access Helper Web reads article DOI values from pages and sends them to open-access lookup APIs.

OshiKoi sends the active page URL to its chat API during system-trigger greeting messages.

PAN AUTO помощник для Encar sends contact form details and selected vehicle context to PAN AUTO's API.

Pinnable ChatGPT accepts auth details from the page URL and renders the supplied email inside the ChatGPT sidebar.

Podio Super Menu sends Podio identifiers to bettersupermenu.com and includes a hardcoded backend password.

Postmann contacts api.country.is to infer your country from your IP address when its popup opens.

Pretty Js sends text you select to linangdata.com and loads its popup content from that server.

Productor for KDP sends KDP book metadata to Productor trademark APIs when users run trademark checks.

Radio Station-to-Station Ext requests the Radio Browser server list over cleartext HTTP when its popup opens.