Low risk browser extensions

FACEIT FORECAST can route FACEIT player and match API lookups through fforecast with a persistent device ID.

Spoof Geolocation exposes stored spoofed location settings to any website and accepts unchecked location updates on its setup page.

WebHID for Firefox exposes a WebHID shim to every site and forwards approved HID reports to a local provider.

WhatsApp Pinned loads its options page stylesheets from cdnjs.cloudflare.com and cdn.jsdelivr.net.

EuroSaver lets eurosaver.net request Amazon product pages and sends extracted product details back over a WebSocket.

CyberGhost Cookie Cleaner shows whitelisted domains through Google's favicon service.

Steam Booster lets Steam pages read extension storage, including the saved Steam API key.

Click and Read extracts scholarly identifiers from web pages and sends them to configured resolver services.

Speaker Booster injects an extension script into every page and frame you visit.

Apia digital signature lets matching webpages send local signing data to its native signing host.

Elasticvue sends a persistent local UUID to its update-check server when the extension UI loads.

Legacy Browser Support lets arbitrary websites invoke its browser-switcher flow for policy-matching URLs.

BetterBLOX sends Roblox presence and playtime activity to BetterBLOX APIs while the user is signed in.

YouTube Shorts Blocker loads Google Fonts from its popup, sending request metadata to Google.

2TOOL Auto Like lets a Facebook URL parameter turn on auto-like actions and checks licenses with a Facebook actor ID.

4media - 4chan Media Downloader sends popup bug-report text to a Discord webhook.

AB korea cars sends vehicle details and the active tab URL to its pricing backend when the popup runs.

ANEF Status Tracker uploads ANEF dossier metadata to a Supabase community statistics endpoint by default.

Ad Skipy fetches remote selector rules and uses them to click matching visible page elements on any site.

Address Finder for Rightmove sends resolved property addresses and a stored user ID to a Supabase analytics endpoint.

The extension sends telemetry with a persistent UUID, user email, browser metadata, and event details to Aliyun Log Service.

Ali Quick sends AliExpress product page visits to imgvidcfig.com and can redirect the tab through a server URL.

Anime Wallpaper sends your most visited site URLs to Google's favicon service on its new tab page.

Anki Tool sends AI auto-fill flashcard details and existing field content to its Cloudflare Worker.

Auto Full Screen for Google Meet clicks the Present control when a Meet URL contains the mesosx=1 parameter.

BMW M5 F90 Live Wallpaper New Tab fetches Gameograf popup HTML and inserts it into its new-tab page.

BPM Changer sends media playback usage sessions and page origins to accounts.api.extensions.ee.

Beamery Extension exposes its app to any website, which can trigger Beamery profile and analytics initialization.

Blocksi AI Web Filter sends visited URLs to Blocksi classification endpoints during browser navigation.

BritVPN sends signed-in user identity, license state, VPN location status, and proxy IP metadata to Amplitude analytics.

Browse.live Ad Control sends visited page URLs and referrers to anonymous.browse.live during browsing.

CAD SCOUT 3Dfindit reads search text or page titles from visited sites and sends matching searches to PARTcommunity.

CFCA CertEnrollment.BankOfLuoYang Extension lets approved banking sites send native-messaging requests to a local host.

CP Calendar fetches coding contest listings from the Clist API with an embedded API key.

Canvas Assistant sends full page URLs from non-Canvas pages to its analytics endpoint.

ChatPDF - AI for Documents loads a remote Imgkits image on matched PDF pages, sending normal request metadata.

The extension lets TikTok and Instagram page scripts request downloads and settings changes through its message bridge.

Christ-Centered sends precise browser geolocation coordinates to OpenWeatherMap for its new-tab weather widget.

Chrome Locker initializes its site-lock password to the hardcoded default value "password".

Classic Minesweeper Offline Game loads popup and options UI images from raw.githubusercontent.com.

Clear History & Web Cache injects a page button that can trigger deletion of configured browsing data.

Click-to-Call for Web and CRM opens caller phone numbers in a cleartext Whitepages lookup URL.

CoPilot EveryWhere removes Copilot security headers so its pages can be embedded by the extension.

Cristiano Ronaldo CR7 Iconic Gaze sends saved new-tab shortcut URLs to Google's favicon service.

Dadan stores recording session IDs and overlay state in page-readable sessionStorage while overlays are active.

Dark Mode -- Night Theme for All Sites adds an extension-derived DOM ID to every top-level page it runs on.

The extension sends a persistent browser client ID to Google Analytics when its content script runs.

DataSpark Tools places its DataSpark API key in a Walmart page iframe URL.

Document Translator sends viewed PDF page URLs to Mixpanel analytics.

Doodle Jump typical sets browser notifications to allow messages from tooldoodlejumpino.digital.

Dynu Dynamic DNS Client reads your public IP address over HTTP before updating Dynu DNS records.

EBSCOhost Passport embeds an EBSCO OAuth client secret and sends it to EBSCO's token endpoint.

Easy Builder's overlay bridge lets scripts on the active page write text to the system clipboard.

Easy Exporter sends Etsy order-export analytics and a persistent client ID to Google Analytics.

LinkedIn Email Finder & Intelligence | Salesgear removes frame-busting headers from embedded pages across all sites.

Ender Miles Morales Snow Time Live Spiderman Wallpaper inserts API-supplied HTML into its new-tab page.

Exponea Console bundles a private RSA key that page scripts can use to send accepted messages to its content script.

F1 Delayed Live Timing sends a persistent user ID with live-timing view telemetry to api.f1delayedlivetiming.com.

FACEIT Detailed CS2 Stats sends a bundled FACEIT API bearer token with its FACEIT stats requests.

Fastcup Enhancer sends Steam profile IDs from FastCup pages to fastcup-enhancer.igoryusha.love with a persistent user ID.