Low risk browser extensions

Delete Facebook Messages removes Facebook Content-Security-Policy headers on page and XHR responses.

Demandbase for Sales lets any HTTPS page ask the extension to open an attacker-chosen URL in a new tab.

Drag Maze sends popup page-view telemetry with a persistent client ID and extension page URL to Google Analytics.

Duolingo Max modifies Duolingo pages to unlock paid subscription features and bypass feature gates.

ESCB-PKI bridges certificate enrollment pages on ESCB and BDE sites to a native messaging host that loads PKCS11 DLLs supplied by the page.

Everything to Notebook extracts text, subtitles, and images from supported pages and syncs them to Notion, Feishu, NotebookLM, or Obsidian.

Eye Saver - Break Reminder injects readable extension font URLs into every page it runs on.

Faceseo sends your Facebook c_user cookie and Faceseo-managed tab activity to faceseo.vn.

Ferrari Wallpaper New Tab sends configured shortcut URLs to Google's favicon service when new-tab shortcuts render.

FluentU sends Netflix and YouTube subtitle text to www.fluentu.com for its language-learning features.

Font Finder by WhatFont places its extension ID in the page DOM when you activate the font overlay.

Form Vault automatically saves form entries and may store password-field values when their field names do not look like passwords.

Free VPN Proxy - Mars sends a proxy-auth check URL to api.telegra.ph when the VPN connects.

Friday Night Funkin Game sends a persistent extension UUID to yoki.games every two minutes.

Friendly Tab - New Tab Page sends typed new-tab search queries to Google autocomplete before search submission.

GamersClub Challenger sends GamersClub profile details and page URLs to Google Analytics on GamersClub pages.

GoTo for Google Chrome exposes its extension presence by injecting a chrome-extension popover iframe on pages.

Good Deal Or Not sends travel page URLs, booking details, prices, active-tab URLs, and page content to its backends.

Elevate by GrowthX sends the Chrome profile email address to GrowthX analytics when the extension is installed.

HTTP Commander lets matching Default.aspx pages tell the browser to download page-supplied files.

Hero Wars Simulator fetches remote game-modification scripts and injects them into Hero Wars pages.

Human Reader lets sidebar pages request navigation rules that remove X-Frame-Options for chosen sites.

Images, icons & photos with ChatGPT lets an OffiDocs server response redirect new browser tabs.

InBest - Calculadora rentabilidad alquiler sends Idealista property URLs to Google Analytics with a persistent client ID.

Influencer insights for Instagram & YouTube sends a bundled GoodCreator client secret to GoodCreator's GraphQL endpoint.

Juicy - Amazon Coupons Finder sends Amazon search terms and coupon product listings to analytics and Juicy Discount servers.

Keyboard ASMR captures keypress categories on every site and sends daily usage counters to keyboardasmr.abhirooprasad.workers.dev.

Lazada Save reports Lazada product-page visits to imgvidcfig.com and can route the tab through a returned URL.

Librofertas reports Buscalibre checkout order and cart details to api.librofertas.com.

Lucen Track widget exposes Timeneye profile details to configured integration pages in iframe URLs.

Maska Method records TikTok request data locally and modifies TikTok publish requests before submission.

Mass Block Twitter sends observed X profiles and recent tweet text to its spam-classification server.

Meteor DevTools Evolved lets any webpage ask the extension to open an arbitrary URL in a new browser tab.

Mockiato lets web pages query stored header profiles and mocks through its messaging bridge.

MyEasy86 sends clicked parcel submissions and product-page URLs from shopping sites to myeasy86.com.

NUSO Connect AC SIP relays arbitrary page messages to a local native host via a forgeable sender-string gate.

Octagon Find appends a persistent extension-generated session ID to searches sent to octagonfind.com.

One-Click TickTick sends the active tab URL, title, and readable page content to TickTick when creating a task.

Pali Wallet lets same-page messages trigger wallet network changes and lock the wallet.

Password Boss WebApp sends page-load and navigation telemetry from visited websites to sentry.passwordboss.com.

Peacock TV Party sends Peacock account, profile, viewing, and customer email data to me3x.online and metricsmint.quest.

Peacock TV Speeder sends Peacock account, profile, viewing, and live-event data to external servers.

Periodic Table of Elements stores a browser client ID on Serbian government portal pages and sends it to Google Analytics.

Pixcall rewrites Referer headers and relaxes CORS for third-party image/CDN requests.

Premium Sender Pro sends your WhatsApp account number and usage telemetry to Google Analytics.

Proxy SwitchyOmega Pro looks up the user's IP address through ip-api.com on every matched page.

Quest PDF sends a generated persistent identifier to reporting.questpdfapp.com when it is installed.

Quick view for fiverr sends Fiverr seller country codes to flagsapi.com when showing country flags.

Quotes New Tab sends selected top-site domains to an Amazon S3 bucket when rendering its new tab logos.

RSS Feed URL Finder loads a remote font stylesheet from fonts.cdnfonts.com when its popup opens.

RecipeBox automatically sends detected recipe-page URLs from mobile pages to api.recipebox.com.

Reddit Comment Scraper uploads saved scrape history, including comment data and Reddit thread URLs, to Supabase.

RepHunter sends Kakobuy order details, QC image links, and coupon redemption data to its servers.

Request X lets any website query user-configured response replacement bodies through its page event bridge.

Retire.JS downloads detector rules from GitHub and evaluates those rule strings in a sandbox while scanning page scripts.

Rick and Morty NewTab redirects every new tab to search.ricktab.com.

Roblox For Chrome sends your most-visited site URLs to Google's favicon service on its new-tab page.

The extension removes Content Security Policy headers from Google pages while it is active.

SPOI Options fetches a patch manifest from lazlo.spoi.com and can load vendor-specified CSS into video pages.

SavvyCal sends location search text and selected coordinates to OpenCage for geosearch and geocoding.