Low risk browser extensions

The extension sends telemetry with a persistent UUID, user email, browser metadata, and event details to Aliyun Log Service.

AliExpress Image Search opens a hidden affiliate tab on AliExpress checkout and sends saved product image URLs to Thieve.

Faceseo links its own account cookie to the user's Facebook account cookie and sends both IDs to faceseo.vn.

AmzTrends sends Amazon page URLs and page contents to api.amztrends.com for product and search analysis.

Ateş Çocuk ve Su Kız 1 Orman Tapınağı sends a persistent extension UUID to yoki.games every two minutes.

Audio Booster works with Disney+ [QVI] sends Disney profile details and viewing activity to remote servers.

Audio Recorder lets websites embed its sidepanel and trigger Amplitude page and referrer telemetry.

BMW M5 F90 Live Wallpaper New Tab fetches Gameograf popup HTML and inserts it into its new-tab page.

Behance Image Downloader watches tab URLs and stores login-success parameters when matching URLs appear.

Better Discord Web unofficial loads a remote Flaticon image when its popup shows a Discord-site error.

BiRead sends visible page text from translated sites to Google, Microsoft, and BiRead translation endpoints.

Bloxgen reads Roblox credentials from login URL parameters and submits them on Roblox.

ByNoGame Auto Trader imports Socket.IO code from cdn.socket.io into its privileged background service worker.

The extension bridges scoped bank and CA web pages to native messaging hosts, but accepts the host name from the caller without validation.

Cat Tab Cursor sends bookmark URLs to Google's favicon service and submits new-tab searches to cattabsearch.com.

Chat Exporter accepts Notion tokens from page messages and sends exported Gemini chats to Backrun's Notion API.

Chat and Meet for Google fetches remote message HTML from jitt.wwevents.fun and renders it in extension pages.

ChatGPT Exporter sends user-triggered ChatGPT exports and Notion export tokens to backrun.co.

ChatGPT Prompt Plus loads a prompt-picker icon from Firebase Storage on ChatGPT pages.

ChatGPT Sidebar by cloudHQ reads ChatGPT session access tokens and stores the auth data in Chrome sync storage.

ChessExpert lets matched pages request a visible-tab JPEG screenshot through its page-to-extension event bridge.

Christmas Wallpaper New Tab sends displayed top-site URLs to Google's favicon service on the new-tab page.

Click-to-call для MANGO OFFICE sends the active tab's domain to Mango Office servers each time a call is initiated.

Collage - Debate Card Cutter and Library imports clipboard HTML into its library and saves it for later restores.

CompanyCam rewrites Facebook, Instagram, and QuickBooks CSP headers to allow inline and eval scripts.

Maska Method records TikTok request data locally and modifies TikTok publish requests before submission.

Convert PDF to Word redirects every new tab to the remote freepdfconversion.com converter page.

CoolStart loads third-party stylesheets and fonts whenever it opens its replacement new tab page.

Coursera Dual Subtitles sends Coursera page host, path, and title to Google Analytics when its subtitle overlay renders.

Cristiano Ronaldo Wallpaper loads Google Fonts from its new-tab page on each new-tab navigation.

Dark Mode for YouTube™ exposes its extension ID and resource base URL to YouTube page scripts.

Delete Facebook Messages removes Facebook Content-Security-Policy headers on page and XHR responses.

Demandbase for Sales lets any HTTPS page ask the extension to open an attacker-chosen URL in a new tab.

Drag Maze sends popup page-view telemetry with a persistent client ID and extension page URL to Google Analytics.

Duolingo Max modifies Duolingo pages to unlock paid subscription features and bypass feature gates.

ESCB-PKI bridges certificate enrollment pages on ESCB and BDE sites to a native messaging host that loads PKCS11 DLLs supplied by the page.

Eye Saver - Break Reminder injects readable extension font URLs into every page it runs on.

Faceseo sends your Facebook c_user cookie and Faceseo-managed tab activity to faceseo.vn.

Fastboy SS Team Manager ships a hardcoded login token and 4-digit passcode for the vendor's own gocheckin.net booking portal.

Ferrari Wallpaper New Tab sends configured shortcut URLs to Google's favicon service when new-tab shortcuts render.

Filestage removes framing protection headers from all subframe responses after detecting its viewer.

Font Finder by WhatFont places its extension ID in the page DOM when you activate the font overlay.

Form Vault automatically saves form entries and may store password-field values when their field names do not look like passwords.

Free VPN Proxy - Mars sends a proxy-auth check URL to api.telegra.ph when the VPN connects.

Friday Night Funkin Game sends a persistent extension UUID to yoki.games every two minutes.

Friendly Tab - New Tab Page sends typed new-tab search queries to Google autocomplete before search submission.

GamersClub Challenger sends GamersClub profile details and page URLs to Google Analytics on GamersClub pages.

Good Deal Or Not sends travel page URLs, booking details, prices, active-tab URLs, and page content to its backends.

HTTP Commander lets matching Default.aspx pages tell the browser to download page-supplied files.

Hero Wars Simulator fetches remote game-modification scripts and injects them into Hero Wars pages.

Human Reader lets sidebar pages request navigation rules that remove X-Frame-Options for chosen sites.

InBest - Calculadora rentabilidad alquiler sends Idealista property URLs to Google Analytics with a persistent client ID.

Influencer insights for Instagram & YouTube sends a bundled GoodCreator client secret to GoodCreator's GraphQL endpoint.

Juicy - Amazon Coupons Finder sends Amazon search terms and coupon product listings to analytics and Juicy Discount servers.

Keyboard ASMR captures keypress categories on every site and sends daily usage counters to keyboardasmr.abhirooprasad.workers.dev.

Klever Wallet lets webpages read stored wallet account addresses through its injected provider.

Librofertas reports Buscalibre checkout order and cart details to api.librofertas.com.

Lucen Track widget exposes Timeneye profile details to configured integration pages in iframe URLs.

Mass Block Twitter sends observed X profiles and recent tweet text to its spam-classification server.

MeaVana sends stored auth tokens to PostHog when logout analytics run after token failures.