Low risk browser extensions

Definer lets any webpage trigger dictionary or AI lookups through the extension without checking the message origin.

Bionic Reader imports Google Fonts CSS on webpages where it auto-applies its reading style.

FACEIT Mappio sends Faceit matchroom player profiles and demo URLs to Mappio analysis servers.

musescore-downloader uses bundled Musescore API tokens to request score files from musescore.com.

Web Paint saves user-created drawings to the current page's local browser storage after the tool is used.

Kinozal Unofficial fetches Kinozal status config and can inject an a-ads.com iframe on Kinozal pages.

Speed Booster for ChatGPT changes ChatGPT page rendering to keep long conversations responsive.

Web Translate lets opened editor pages remove frame-protection headers for subframes in the current tab.

Snapchat web changes Snapchat camera and microphone permission checks into media access requests.

Reading List requests DuckDuckGo favicons for the hostnames saved in your reading list.

CopyTabTitleUrl reads the active tab's document.cookie when its scripting copy option is enabled.

ContextSearch web-ext lets web pages prompt users to save attacker-supplied search templates through its add-engine page.

1stream Client sends page hostnames to a bvoip endpoint when its webclient injection runs.

AI Code Generator sends your Chrome profile Google ID to livepolls.app during setup.

AI Image Editor uploads user image files to Alibaba OSS using hardcoded storage credentials embedded in its bundle.

AIHR Member Start Page records its new-tab page with Datadog RUM session replay.

AIVA sends ChatGPT account identifiers and a device fingerprint to app2.aiva.best when ChatGPT loads.

AdTech.dev Ad Inspector collects ad-tech, bidder, identity, consent, and page URL data from every site into browser storage.

AeroKick lets matched Kick and AeroKick pages use a message bridge to call extension fetch and storage proxy methods.

Agent Quick Tools removes shopping-agent risk warnings and auto-confirms LitBuy purchase notices.

Alibaba Image Downloader exposes a page-message route that lets webpages ask it to open arbitrary URLs in tabs or windows.

Altmetric for Pubmed and Google Scholar sends page .docsum-pmid text to api.altmetric.com as PubMed IDs.

Amazing Screenshot and Annotate Tool lets any webpage trigger its screenshot shortcuts for the active tab.

Amazon Subscribe & Save one-click cancel sends Amazon-page error reports and page details to Raygun when crashes occur.

Amz Price History Pro copies the stored Keepa login token into localStorage on matched 127.0.0.1 pages.

App for WhatsApp and Messenger access removes security headers on messaging and social sites.

ArmRadio fetches its station catalog over HTTP and plays station URLs supplied by that catalog.

Askusdaily sends Chrome Top Sites hostnames to Google's favicon service when its new-tab page opens.

AssetConnect fetches ad configuration from ads.sakurayuki.dev and can load remote ad images when its popup opens.

Atria Chrome helps save ads from social media pages into Atria.

Attack On Titan Levi Wallpaper sends top visited site URLs to Google's favicon service on the new-tab page.

Autify Recorder (New) turns page-sent keystroke messages into Chrome Debugger key presses during recording or replay.

AutoRemote sends entered short device URLs to Google URL Shortener when adding a device.

Autotype - Free Text Expander accepts webpage messages that insert supplied HTML into the focused editable field.

Autoview.com Trading Extension modifies Origin and Referer headers on requests to trading and exchange domains.

BMW M3 Neon Night Drive Live Wallpaper sends saved shortcut URLs to Google for favicon loading.

BMW M4 CSI Night Dirft Live Wallpaper loads Google Fonts resources each time its new-tab page opens.

BMW M4 City Ride Live Wallpaper loads remote popup HTML into its new-tab page.

Backspace for Navigation lets page-generated Backspace events close the current tab when close-on-history-top is enabled.

Backstory places its extension runtime ID in the page after you activate it on a tab.

Bad Time Simulator Sans Fight Game opens cargames.click install and uninstall pages from its background worker.

BearPass lets any website submit an external-auth token that the extension sends to the configured BearPass API host.

BetterBluesky sends your Bluesky handle, DID, and per-load session ID to its API after bsky.app loads.

Beşiktaş JK Anasayfa sends new-tab and activity telemetry to m.instantsearch.net.

Bitmoji Hot loads remote Twemoji JavaScript into every HTTPS page where its content script runs.

Block Page Assistant sends failed HTTPS navigation domains to mytools.management before showing an HTTP block page.

Sidebar Bookmarks sends a persistent user ID, license code, and bookmark counters to the developer API.

Botpresso SEO Extension sends the active tab URL or origin to Google CrUX for Web Vitals lookup.

Brave Browser for PC version - New Tab BG loads its new-tab stylesheet from unpkg.com on every render.

CMG Hacks sets a Coolmathgames premium-play cookie and modifies Coolmathgames game pages to skip ad UI.

CR Dual Subtitles sends Crunchyroll tab details and subtitle translation text to Amplitude during translation.

Canva Premium Remover stores persistent hashed Canva account identifiers in browser sync storage.

Canvas files Downloader lets any course-shaped page trigger extension-privileged file downloads.

Card Bookmarks uploads cloud-synced bookmarks and tab backups to aa-zz.cn and records page visits locally.

Celonis Task Mining captures clicks, clipboard text, and form input on every page and sends them to a local desktop client over a WebSocket.

Chapax lets webpages trigger its screenshot capture flow and uploads selected screenshots to app.chapax.ai.

Chat Assistant For TT sends usage events with a persistent UUID and browser metadata to Aliyun SLS.

ChatGPT Exporter sends user-triggered ChatGPT exports and Notion export tokens to backrun.co.

Clippy fetches remote comment text and renders matching messages as HTML on pages where its content script runs.

Close Tab loads a Buy Me a Coffee badge from cdn.buymeacoffee.com when you open its options page.