Low risk browser extensions

CommenTron sends LinkedIn post and reply context to RocketPod after users click its injected AI comment controls.

Copy Cat loads its popup game's audio files over cleartext HTTP from www.noiseforfun.com.

Creator Hooks sends visible YouTube video IDs from YouTube pages to app.creatorhooks.com for saved-state lookups.

Crunchyroll Ad Skipper [QVI] sends Crunchyroll profile, watch history, and subscription data to me3x.online.

Cute Save Button lets pages trigger downloads of attacker-chosen media URLs.

Cyberpunk 2077 Themed Homepage sends configured RSS feed URLs to api.allorigins.win when its RSS widget is used.

CÔNG CỤ ĐẶT HÀNG GIANG HUY LOGISTICS evaluates page scripts on supported shopping sites.

D&D Beyond DM-Screen sends D&D Beyond page URLs and settings telemetry to a Matomo endpoint.

DESelect Search sends each SFMC search term and saved user email to DESelect's log endpoint.

DG Edge lets any website overwrite its stored profile claim data through a page message bridge.

DICOM image viewer lets any website trigger extension-privileged fetches of DICOM URLs.

Demon Slayer Live Wallpaper Gameograf inserts remote Gameograf popup HTML into its new-tab page.

Demon Slayer Nezuko Chibi Wallpaper New Tab sends most-visited site URLs to Google for favicon lookups.

Diccionario RAE en bocadillo downloads redirect rules that can control main-frame navigation.

Disable Passkeys lets any page trigger its passkey-intervention event and increments a synced intervention counter.

DocSend Slide Deck Downloader adds wildcard CORS headers to CloudFront image and XHR responses.

Domain Appraisal by Atom.com sends domain appraisal requests with a built-in Chrome extension secret to Atom.

Double Click Image Downloader lets web pages trigger downloads from page-controlled image URLs.

Duplicate Tab Helper loads remote HTML from justinreinhart.com into its options page.

Dutycast sends the current page URL from every site to its config API with a persistent extension UID.

Easy Social Searcher posts search-related telemetry and persistent browser identifiers to usage endpoints.

Ecosia Dark Mode sends your top visited site URLs to Google's favicon service on its new-tab page.

Edge Text to Speech Voice Reader lets pages trigger text-to-speech and sends the chosen text to Microsoft Bing Speech.

Einsia accepts page messages that can trigger authenticated parse-file requests to einsia.ai.

Email Zoom Text Reader by cloudHQ sends your Gmail address, timezone, and current Gmail URL to cloudHQ when Gmail loads.

Extract video playback link lets any HTTP(S) page trigger extension-privileged downloads for chosen URLs.

FPTU Move Out Class Tool sends a persistent client ID and timezone to a Cloudflare Workers tracking endpoint.

FRAK - Earn Money Watching YouTube sends YouTube watch-session details to FRAK reward APIs and Mixpanel.

Firma con token forwards messages from allowed government sites to the local gcbatoken native messaging host.

Flagmoji sends flag emoji image requests from every page to flagmoji.lecaominhhn.workers.dev.

Flixsign Web PKI lets matching web pages send localStorage-derived signing commands to its local PKI native host.

Followers & Unfollowers sends Instagram profile and follower-list metrics to betaworkz.com analytics.

Forest Wallpaper sends top-site URLs from the new tab page to Google's favicon service.

Framer Checker sends the origins of detected Framer-built sites to script.cursodeframer.com.br.

Free Pocket Option Bot sends PocketOption account UIDs to 2bot.top during WebSocket balance updates.

TrackMailBox scans Gmail sent-folder rows and sends message metadata to its backend.

Free VPN | Fast Secure VPN - VPN Control sends public IP and VPN usage events to hdbest.fun.

GMB Page - CID & PlaceID Finder sends Google Maps business details from place pages to chrome.gothru.co.

Gemini Watermark Remover - Banana Clean sends a hashed device fingerprint to its trial-tracking server.

Gemini to PDF Saver exports Gemini chats to PDFs and uses a hardcoded local code to remove its watermark.

GenTech - Browser Tools retrieves the filtering username from filterstatus.com over cleartext HTTP.

GeoGuessr timer loads Google Fonts when its settings or saved-times pages open.

Get YouTube Transcript by CakeAI sends YouTube transcript contents and video metadata to cacheyoutubetranscript.totext.xyz.

Goin sends matched shopping page URLs and referrers to Mixpanel and Braze analytics.

GoodPlan stores encrypted notes locally using a passphrase shipped inside the extension bundle.

Goodhue sends selected and hovered image URLs to Goodhue-hosted services.

Google Account Easy Switch appends the selected Google account index to the active tab URL, even on non-Google sites.

Google Meet Attendance Tracker (new) stores participant names and IDs in Google Meet localStorage during tracking.

Grips sends visited domains to a CloudFront endpoint and posts active-tab page views to Google Analytics on extension clicks.

Haikyuu Wallpaper sends URLs from your browser's top sites to Google's favicon service on the new-tab page.

Hexomatic lets configured localhost pages overwrite stored authentication values used for its API calls.

Hotmail sends Microsoft OAuth client credentials to Microsoft's token endpoint during sign-in and token refresh.

Humantic AI lets page scripts on supported sites trigger authenticated requests to api.humantic.ai.

ImportKit forces on a hidden search insights module that sends Goofish and Taobao search terms to Supabase.

Influence4You reads public profile email addresses and sends them to app.influence4you.com.

Inspect Element creates a persistent Amplitude ID and sends usage telemetry to api.amplitude.com.

Jace Gmail Extension sends a bundled bearer token to a Zeta Labs dev API when its popup polls thread data.

JavaScript Errors Notifier lets webpages request extension storage option values through its all-sites message bridge.

Jinno lets any website overwrite the extension account session through its page message bridge.

Joke Of The Day loads Google Fonts when its extension popup is opened.