Low risk browser extensions

WhatsApp Pinned loads its options page stylesheets from cdnjs.cloudflare.com and cdn.jsdelivr.net.

Yahoo Search Addon sends a persistent client ID and browser environment details to Yahoo on install and every four hours.

Mapio sends Google search queries and stored identifiers to mpestate.azurewebsites.net after its consent flag is set.

CyberGhost Cookie Cleaner shows whitelisted domains through Google's favicon service.

BetterBLOX sends Roblox presence and playtime activity to BetterBLOX APIs while the user is signed in.

YouTube Shorts Blocker loads Google Fonts from its popup, sending request metadata to Google.

Stock Tab lets tradeecon.com remotely change where new-tab search terms are sent.

Steam Booster lets Steam pages read extension storage, including the saved Steam API key.

Elasticvue sends a persistent local UUID to its update-check server when the extension UI loads.

Speaker Booster injects an extension script into every page and frame you visit.

ChatGPT in Sidebar loads third-party stylesheets when its options page opens.

YouTube to MP3 injects a hidden remove.video iframe into every visited page after install or update.

PubPeer sends publication URLs, DOIs, and PMIDs found on pages to pubpeer.com for comment lookups.

Legacy Browser Support lets arbitrary websites invoke its browser-switcher flow for policy-matching URLs.

2TOOL Auto Like lets a Facebook URL parameter turn on auto-like actions and checks licenses with a Facebook actor ID.

4media - 4chan Media Downloader sends popup bug-report text to a Discord webhook.

AB korea cars sends vehicle details and the active tab URL to its pricing backend when the popup runs.

Ad Skipy fetches remote selector rules and uses them to click matching visible page elements on any site.

The extension sends telemetry with a persistent UUID, user email, browser metadata, and event details to Aliyun Log Service.

Ali Quick sends AliExpress product page visits to imgvidcfig.com and can redirect the tab through a server URL.

Anime Wallpaper sends your most visited site URLs to Google's favicon service on its new tab page.

Anki Tool sends AI auto-fill flashcard details and existing field content to its Cloudflare Worker.

Auto Full Screen for Google Meet clicks the Present control when a Meet URL contains the mesosx=1 parameter.

BMW M5 F90 Live Wallpaper New Tab fetches Gameograf popup HTML and inserts it into its new-tab page.

BPM Changer sends media playback usage sessions and page origins to accounts.api.extensions.ee.

Beamery Extension exposes its app to any website, which can trigger Beamery profile and analytics initialization.

Blocksi AI Web Filter sends visited URLs to Blocksi classification endpoints during browser navigation.

Bloxgen reads Roblox credentials from login URL parameters and submits them on Roblox.

BritVPN sends signed-in user identity, license state, VPN location status, and proxy IP metadata to Amplitude analytics.

Browse.live Ad Control sends visited page URLs and referrers to anonymous.browse.live during browsing.

B站bilibil弹幕下载生成ASS字幕 can send downloaded Bilibili danmaku and video metadata to a server-supplied URL.

CAD SCOUT 3Dfindit reads search text or page titles from visited sites and sends matching searches to PARTcommunity.

CFCA CertEnrollment.BankOfLuoYang Extension lets approved banking sites send native-messaging requests to a local host.

CP Calendar fetches coding contest listings from the Clist API with an embedded API key.

Canvas Assistant sends full page URLs from non-Canvas pages to its analytics endpoint.

ChatPDF - AI for Documents loads a remote Imgkits image on matched PDF pages, sending normal request metadata.

The extension lets TikTok and Instagram page scripts request downloads and settings changes through its message bridge.

Christ-Centered sends precise browser geolocation coordinates to OpenWeatherMap for its new-tab weather widget.

Chrome Locker initializes its site-lock password to the hardcoded default value "password".

Classic Minesweeper Offline Game loads popup and options UI images from raw.githubusercontent.com.

Clear History & Web Cache injects a page button that can trigger deletion of configured browsing data.

Click-to-Call for Web and CRM opens caller phone numbers in a cleartext Whitepages lookup URL.

CoPilot EveryWhere removes Copilot security headers so its pages can be embedded by the extension.

Cristiano Ronaldo CR7 Iconic Gaze sends saved new-tab shortcut URLs to Google's favicon service.

Dadan stores recording session IDs and overlay state in page-readable sessionStorage while overlays are active.

Dark Mode -- Night Theme for All Sites adds an extension-derived DOM ID to every top-level page it runs on.

The extension sends a persistent browser client ID to Google Analytics when its content script runs.

DataSpark Tools places its DataSpark API key in a Walmart page iframe URL.

Document Translator sends viewed PDF page URLs to Mixpanel analytics.

Doodle Jump typical sets browser notifications to allow messages from tooldoodlejumpino.digital.

Dynu Dynamic DNS Client reads your public IP address over HTTP before updating Dynu DNS records.

EBSCOhost Passport embeds an EBSCO OAuth client secret and sends it to EBSCO's token endpoint.

Easy Builder's overlay bridge lets scripts on the active page write text to the system clipboard.

Easy Exporter sends Etsy order-export analytics and a persistent client ID to Google Analytics.

LinkedIn Email Finder & Intelligence | Salesgear removes frame-busting headers from embedded pages across all sites.

Ender Miles Morales Snow Time Live Spiderman Wallpaper inserts API-supplied HTML into its new-tab page.

Exponea Console bundles a private RSA key that page scripts can use to send accepted messages to its content script.

F1 Delayed Live Timing sends a persistent user ID with live-timing view telemetry to api.f1delayedlivetiming.com.

FACEIT Detailed CS2 Stats sends a bundled FACEIT API bearer token with its FACEIT stats requests.

Fastcup Enhancer sends Steam profile IDs from FastCup pages to fastcup-enhancer.igoryusha.love with a persistent user ID.