Low risk browser extensions

DataSpark Tools places its DataSpark API key in a Walmart page iframe URL.

Document Translator sends viewed PDF page URLs to Mixpanel analytics.

Doodle Jump typical sets browser notifications to allow messages from tooldoodlejumpino.digital.

Dynu Dynamic DNS Client reads your public IP address over HTTP before updating Dynu DNS records.

EBSCOhost Passport embeds an EBSCO OAuth client secret and sends it to EBSCO's token endpoint.

Easy Exporter sends Etsy order-export analytics and a persistent client ID to Google Analytics.

LinkedIn Email Finder & Intelligence | Salesgear removes frame-busting headers from embedded pages across all sites.

Ender Miles Morales Snow Time Live Spiderman Wallpaper inserts API-supplied HTML into its new-tab page.

Exponea Console bundles a private RSA key that page scripts can use to send accepted messages to its content script.

F1 Delayed Live Timing sends a persistent user ID with live-timing view telemetry to api.f1delayedlivetiming.com.

FACEIT Detailed CS2 Stats sends a bundled FACEIT API bearer token with its FACEIT stats requests.

Fastcup Enhancer sends Steam profile IDs from FastCup pages to fastcup-enhancer.igoryusha.love with a persistent user ID.

Fatfox新标签页 sends search terms from visited URLs to Goosetab's AI message API.

FindFlix sends Netflix account identity and remotely selected viewing, profile, device, list, and downloads data to outside servers.

Firma con token forwards messages from allowed government sites to the local gcbatoken native messaging host.

Flexi - AI Tutor sends active-page context to CK12 while its side panel is open.

The extension queries api.ipify.org for your public IP address when its background service worker starts.

Free Downloader Online DomainB Video rewrites CORS and frame headers on media playlist and segment XHR responses.

Full Picture accepts page messages that send article text, page title, and URL to www.fullpicture.app.

FuseBase Clarity lets webpages set the session ID later sent with screenshot and video uploads.

GPTOnline sends search-page queries and browser metadata to chatt.gptonline.ai.

GTA 5 Wallpaper sends Chrome top-sites URLs to Google's favicon service when its new-tab page loads.

GaiaUpgrade sends Gaia avatar image URLs to cors-fix.web.app when exporting favorites.

Galaxy Search sends new-tab geolocation to OpenWeatherMap and top-site domains to Google's favicon service.

Gastronomy Tab sends Chrome top-site hostnames to Google when showing new-tab favicons.

GetVM removes Content-Security-Policy and X-Frame-Options headers from browser requests.

HBO Max Extended shares Max/HBO account identifiers and viewing data with me3x.online and metricsmint.quest by default.

HedNet Protocol Extension fetches your public IP address from api.ipify.org while its popup is open.

Hello Kitty Live Wallpaper sends saved new-tab shortcut URLs to Google's favicon service when the page renders.

Hello Kitty Wallpapers HD New Tab sends custom shortcut URLs to Google's favicon service.

Hexofy Scraper sends newly visited page URLs to Hexofy's GraphQL API while you are signed in.

Hide Expert VPN sends your screen dimensions to a third-party analytics API after installation.

Hide shorts for Youtube™ contacts Google Fonts from its popup when you open the extension menu.

Hulu Skipper sends Hulu watch history and account profile details to me3x.online and metricsmint.quest.

IPTV Player sends anonymous usage events and a persistent analytics identifier to Google Analytics.

IRCTC Tatkal Autofill Assistant stores saved booking profiles in local extension storage as plaintext by default.

Infinite Craft Mini Extension includes hardcoded Pusher credentials in its shipped source.

JokeTab injects a content script on every site that reports visited page URLs and shopping-domain activity to events.givefreely.com.

Jump To Recipe sends detected recipe-page URLs to jump-to-recipe-flask.onrender.com.

Kahoot Hacker fetches remote config that can inject a full-screen verification overlay into Kahoot pages.

KanColle-YPS sends user-triggered fleet deck exports to kancolle-calc.net in a cleartext HTTP URL.

Lamborghini Revuelto Opera Unica Wallpapers loads Gameograf-provided shortcuts and popup HTML on its new-tab page.

LeetCode to Russian sends a persistent extension UUID and LeetCode problem ID to its API on problem pages.

LightPDF Translator sends full page URLs and persistent analytics IDs to Google Analytics when translating.

Litmus lets same-page messages trigger uploads of the current page HTML to litmus.com using the stored API token.

LyBox sends supported real-estate browsing URLs to api.lybox.fr when matching pages finish loading.

M3U8 Downloader Pro captures request headers from browsing and can replay them to m3u8.dev download pages.

MagyarAnimeTweaks lets embedding pages request direct media URLs from Rumble, Videa, and Indavideo player frames.

Malware Protection sends visited site hostnames and paths, plus search-result hostnames, to SiteAdvisor for safety checks.

Mclaren Wallpaper New Tab sends shortcut URLs to Google's favicon service when it renders non-bundled shortcuts.

Microsoft Word Translator ships recoverable Alibaba Cloud OSS access credentials in its popup source.

Minecraft Live Wallpaper sends custom shortcut URLs to Google's favicon service when rendering the new-tab page.

Mobile Friendly Test sends the tested page URL to Google PageSpeed with an embedded API key.

Nametag writes its extension enablement settings into each webpage's window and localStorage.

NetMeter Web records all-site bandwidth telemetry, including request origins, resource categories, byte counts, and selected URLs.

Netsweeper Client Filter sends every URL you visit, tagged with your Google account email, to an admin-configured policy server.

NihongoTube submits YouTube video details, transcript-derived metrics, and an extension fingerprint to api.nihongotube.app.

Nintondo Wallet lets any web page claim another site's wallet session origin and reuse an existing connection.

NotePADD embeds a Google OAuth client secret and sends it to Google's token endpoint during Drive sign-in.

NotebookLM Source Helper answers flashcard requests from embedded scf.usercontent.goog frames without origin checks.