Low risk browser extensions

Fatfox新标签页 sends search terms from visited URLs to Goosetab's AI message API.

FindFlix sends Netflix account identity and remotely selected viewing, profile, device, list, and downloads data to outside servers.

Flexi - AI Tutor sends active-page context to CK12 while its side panel is open.

FlyMSG sends text from editable fields to WebSpellChecker for grammar, autocorrect, and autocomplete checks.

Follower Watch - IG Tracker routes Instagram profile image URLs through a workers.dev proxy.

The extension queries api.ipify.org for your public IP address when its background service worker starts.

Free Downloader Online DomainB Video rewrites CORS and frame headers on media playlist and segment XHR responses.

GPTOnline sends search-page queries and browser metadata to chatt.gptonline.ai.

GTA 5 Wallpaper sends Chrome top-sites URLs to Google's favicon service when its new-tab page loads.

GaiaUpgrade sends Gaia avatar image URLs to cors-fix.web.app when exporting favorites.

Galaxy Search sends new-tab geolocation to OpenWeatherMap and top-site domains to Google's favicon service.

Gastronomy Tab sends Chrome top-site hostnames to Google when showing new-tab favicons.

GetVM removes Content-Security-Policy and X-Frame-Options headers from browser requests.

H1B Sponsor Checker exposes a company details page that can send stored access codes to its API for employer searches.

HBO Max Extended shares Max/HBO account identifiers and viewing data with me3x.online and metricsmint.quest by default.

HedNet Protocol Extension fetches your public IP address from api.ipify.org while its popup is open.

Hello Kitty Live Wallpaper sends saved new-tab shortcut URLs to Google's favicon service when the page renders.

Hello Kitty Wallpapers HD New Tab sends custom shortcut URLs to Google's favicon service.

Hexofy Scraper sends newly visited page URLs to Hexofy's GraphQL API while you are signed in.

Hide Expert VPN sends your screen dimensions to a third-party analytics API after installation.

Hide shorts for Youtube™ contacts Google Fonts from its popup when you open the extension menu.

Hulu Skipper sends Hulu watch history and account profile details to me3x.online and metricsmint.quest.

IPTV Player sends anonymous usage events and a persistent analytics identifier to Google Analytics.

Infinite Craft Mini Extension includes hardcoded Pusher credentials in its shipped source.

JokeTab injects a content script on every site that reports visited page URLs and shopping-domain activity to events.givefreely.com.

Jump To Recipe sends detected recipe-page URLs to jump-to-recipe-flask.onrender.com.

Kahoot Hacker fetches remote config that can inject a full-screen verification overlay into Kahoot pages.

KanColle-YPS sends user-triggered fleet deck exports to kancolle-calc.net in a cleartext HTTP URL.

Lamborghini Revuelto Opera Unica Wallpapers loads Gameograf-provided shortcuts and popup HTML on its new-tab page.

LeetCode to Russian sends a persistent extension UUID and LeetCode problem ID to its API on problem pages.

LightPDF Translator sends full page URLs and persistent analytics IDs to Google Analytics when translating.

Litmus lets same-page messages trigger uploads of the current page HTML to litmus.com using the stored API token.

LyBox sends supported real-estate browsing URLs to api.lybox.fr when matching pages finish loading.

M3U8 Downloader Pro captures request headers from browsing and can replay them to m3u8.dev download pages.

MagyarAnimeTweaks lets embedding pages request direct media URLs from Rumble, Videa, and Indavideo player frames.

Malware Protection sends visited site hostnames and paths, plus search-result hostnames, to SiteAdvisor for safety checks.

Mclaren Wallpaper New Tab sends shortcut URLs to Google's favicon service when it renders non-bundled shortcuts.

Minecraft Live Wallpaper sends custom shortcut URLs to Google's favicon service when rendering the new-tab page.

Mobile Friendly Test sends the tested page URL to Google PageSpeed with an embedded API key.

Nametag writes its extension enablement settings into each webpage's window and localStorage.

NetMeter Web records all-site bandwidth telemetry, including request origins, resource categories, byte counts, and selected URLs.

NihongoTube submits YouTube video details, transcript-derived metrics, and an extension fingerprint to api.nihongotube.app.

Nintondo Wallet lets any web page claim another site's wallet session origin and reuse an existing connection.

NotePADD embeds a Google OAuth client secret and sends it to Google's token endpoint during Drive sign-in.

NotebookLM Source Helper answers flashcard requests from embedded scf.usercontent.goog frames without origin checks.

Notes Online sends a persistent user ID and note count to Mixpanel when the extension starts.

Online Piano can send extension-page session usage telemetry to accounts.api.extensions.ee.

Opinew Shopify Reviews Importer sends Shopify shop owner details to Segment analytics from supported pages.

Our Mouse Gesture lets page-dispatched mouse events trigger tab, window, and history actions through the extension.

Ozon Stats imports its popup font stylesheet from Google Fonts when the popup opens.

PDF Bookmark scans page HTML for a hardcoded keyword and stores matching page URLs with match counts in memory.

PDFAid loads Google-hosted fonts from its popup, causing requests to Google font domains when the popup opens.

PaperDebugger sends Overleaf page URLs and hashed page titles to Google Analytics when its page script initializes.

PasswordPocket accepts web-page messages that can save page-supplied credentials while the extension is unlocked.

Payscore lets any web page send a logout message that clears saved extension auth state.

Pinterest Dark Theme loads remote Google Fonts and cdnjs stylesheets when you open its popup.

Pinterest Dark Theme Revanced loads donation button images from img.buymeacoffee.com in its extension UI.

Pogline fetches site-wide request and page-modification rules from pogline.com.

Post and Search sends each new-tab top-site hostname to Google's favicon service.

Productor for Spreadshirt sends bundled Basic Auth credentials to Productor trademark search API endpoints.