Low risk browser extensions

Urban Shield VPN lets any clicked webpage link add and select a custom DNS server for the VPN connection.

VR Dashboard I.T.Y.C. records Virtual Regatta fleet, rank, and option data to vr.ityc.fr by default.

Video Hızlandırcı loads Google Fonts stylesheets when its popup opens.

Voys Klik-en-bel lets pages trigger click-to-dial calls through the signed-in Voys account.

WA Bulk Sender injects a WhatsApp Web bridge that runs send, group and contact commands from any page message.

WAExpresso sends your WhatsApp number, extension ID, and usage counters to its license server.

Window AI trusts page-supplied origin metadata, letting sites reuse previously allowed AI permissions.

Wizzwoods removes Content-Security-Policy and X-Frame-Options headers on Twitter/X pages and frames.

WormWorld Connect Light redirects Wormate's game script to a WormWorld-hosted replacement.

X-Alpha sends scraped X/Twitter tweet and profile details to its AWS backend.

Zopi loads Google Fonts from content scripts that run on every visited page.

iCloud Hide My Email lets any webpage trigger alias generation and reservation through its injected email-field bridge.

pixiv smart downloader lets any website trigger its saved Pixiv image ZIP download workflow.

uGet Integration intercepts downloads and passes cookies and POST form data to the locally-installed uGet download manager via native messaging.

view xml file | XML Formatter lets page scripts open an extension tab with detected XML content.

The extension opens a remotely configured homepage tab after install or update.

讯飞同传AI悬浮字幕插件 writes its runtime ID into the page DOM after opening its panel.

BetterBLOX sends Roblox presence and playtime activity to BetterBLOX APIs while the user is signed in.

WhatsApp Pinned loads its options page stylesheets from cdnjs.cloudflare.com and cdn.jsdelivr.net.

CyberGhost Cookie Cleaner shows whitelisted domains through Google's favicon service.

Yahoo Search Addon sends a persistent client ID and browser environment details to Yahoo on install and every four hours.

Mapio sends Google search queries and stored identifiers to mpestate.azurewebsites.net after its consent flag is set.

Stock Tab lets tradeecon.com remotely change where new-tab search terms are sent.

SEI++ exposes its extension runtime URL inside SEI page DOM nodes on matching .br sites.

GeoSpoof lets webpages disable its in-page WebRTC protection before probing IP candidates.

Steam Booster lets Steam pages read extension storage, including the saved Steam API key.

YouTube to MP3 injects a hidden remove.video iframe into every visited page after install or update.

Speaker Booster injects an extension script into every page and frame you visit.

Elasticvue sends a persistent local UUID to its update-check server when the extension UI loads.

PubPeer sends publication URLs, DOIs, and PMIDs found on pages to pubpeer.com for comment lookups.

FACEIT Mappio sends Faceit matchroom player profiles and demo URLs to Mappio analysis servers.

2TOOL Auto Like lets a Facebook URL parameter turn on auto-like actions and checks licenses with a Facebook actor ID.

4media - 4chan Media Downloader sends popup bug-report text to a Discord webhook.

AB korea cars sends vehicle details and the active tab URL to its pricing backend when the popup runs.

Ad Skipy fetches remote selector rules and uses them to click matching visible page elements on any site.

Ali Quick sends AliExpress product page visits to imgvidcfig.com and can redirect the tab through a server URL.

Anime Wallpaper sends your most visited site URLs to Google's favicon service on its new tab page.

Anki Tool sends AI auto-fill flashcard details and existing field content to its Cloudflare Worker.

Auto Full Screen for Google Meet clicks the Present control when a Meet URL contains the mesosx=1 parameter.

BPM Changer sends media playback usage sessions and page origins to accounts.api.extensions.ee.

Beamery Extension exposes its app to any website, which can trigger Beamery profile and analytics initialization.

Watch BBC iPlayer, ITV & Channel 4 Abroad routes UK streaming sites through LivingAbroad.tv's proxy.

Blocksi AI Web Filter sends visited URLs to Blocksi classification endpoints during browser navigation.

BritVPN sends signed-in user identity, license state, VPN location status, and proxy IP metadata to Amplitude analytics.

B站bilibil弹幕下载生成ASS字幕 can send downloaded Bilibili danmaku and video metadata to a server-supplied URL.

CAD SCOUT 3Dfindit reads search text or page titles from visited sites and sends matching searches to PARTcommunity.

CFCA CertEnrollment.BankOfLuoYang Extension lets approved banking sites send native-messaging requests to a local host.

CP Calendar fetches coding contest listings from the Clist API with an embedded API key.

ChatPDF - AI for Documents loads a remote Imgkits image on matched PDF pages, sending normal request metadata.

The extension lets TikTok and Instagram page scripts request downloads and settings changes through its message bridge.

Christ-Centered sends precise browser geolocation coordinates to OpenWeatherMap for its new-tab weather widget.

Chrome Locker initializes its site-lock password to the hardcoded default value "password".

Classic Minesweeper Offline Game loads popup and options UI images from raw.githubusercontent.com.

Clear History & Web Cache injects a page button that can trigger deletion of configured browsing data.

Click-to-Call for Web and CRM opens caller phone numbers in a cleartext Whitepages lookup URL.

CoPilot EveryWhere removes Copilot security headers so its pages can be embedded by the extension.

Cristiano Ronaldo CR7 Iconic Gaze sends saved new-tab shortcut URLs to Google's favicon service.

Dadan stores recording session IDs and overlay state in page-readable sessionStorage while overlays are active.

Dark Mode -- Night Theme for All Sites adds an extension-derived DOM ID to every top-level page it runs on.

The extension sends a persistent browser client ID to Google Analytics when its content script runs.