Low risk browser extensions

Canvas files Downloader lets any course-shaped page trigger extension-privileged file downloads.

Card Bookmarks uploads cloud-synced bookmarks and tab backups to aa-zz.cn and records page visits locally.

Celonis Task Mining captures clicks, clipboard text, and form input on every page and sends them to a local desktop client over a WebSocket.

Chapax lets webpages trigger its screenshot capture flow and uploads selected screenshots to app.chapax.ai.

Chat Assistant For TT sends usage events with a persistent UUID and browser metadata to Aliyun SLS.

ChatGPT Exporter sends user-triggered ChatGPT exports and Notion export tokens to backrun.co.

Chrome Reload All Tabs lets any web page click its injected widget to reload browser tabs.

Clippy fetches remote comment text and renders matching messages as HTML on pages where its content script runs.

Close Tab loads a Buy Me a Coffee badge from cdn.buymeacoffee.com when you open its options page.

CommenTron sends LinkedIn post and reply context to RocketPod after users click its injected AI comment controls.

Copy Cat loads its popup game's audio files over cleartext HTTP from www.noiseforfun.com.

Creator Hooks sends visible YouTube video IDs from YouTube pages to app.creatorhooks.com for saved-state lookups.

Crunchyroll Ad Skipper [QVI] sends Crunchyroll profile, watch history, and subscription data to me3x.online.

Cute Save Button lets pages trigger downloads of attacker-chosen media URLs.

Cyberpunk 2077 Themed Homepage sends configured RSS feed URLs to api.allorigins.win when its RSS widget is used.

CÔNG CỤ ĐẶT HÀNG GIANG HUY LOGISTICS evaluates page scripts on supported shopping sites.

D&D Beyond DM-Screen sends D&D Beyond page URLs and settings telemetry to a Matomo endpoint.

DESelect Search sends each SFMC search term and saved user email to DESelect's log endpoint.

DG Edge lets any website overwrite its stored profile claim data through a page message bridge.

DICOM image viewer lets any website trigger extension-privileged fetches of DICOM URLs.

Demon Slayer Live Wallpaper Gameograf inserts remote Gameograf popup HTML into its new-tab page.

Demon Slayer Nezuko Chibi Wallpaper New Tab sends most-visited site URLs to Google for favicon lookups.

Diccionario RAE en bocadillo downloads redirect rules that can control main-frame navigation.

Dimensions requests a Font Awesome stylesheet from cdnjs.cloudflare.com when its popup opens.

Disable Passkeys lets any page trigger its passkey-intervention event and increments a synced intervention counter.

DocSend Slide Deck Downloader adds wildcard CORS headers to CloudFront image and XHR responses.

Domain Appraisal by Atom.com sends domain appraisal requests with a built-in Chrome extension secret to Atom.

Double Click Image Downloader lets web pages trigger downloads from page-controlled image URLs.

Duplicate Tab Helper loads remote HTML from justinreinhart.com into its options page.

Dutycast sends the current page URL from every site to its config API with a persistent extension UID.

Easy Social Searcher posts search-related telemetry and persistent browser identifiers to usage endpoints.

Ecosia Dark Mode sends your top visited site URLs to Google's favicon service on its new-tab page.

Edge Text to Speech Voice Reader lets pages trigger text-to-speech and sends the chosen text to Microsoft Bing Speech.

Einsia accepts page messages that can trigger authenticated parse-file requests to einsia.ai.

Email Zoom Text Reader by cloudHQ sends your Gmail address, timezone, and current Gmail URL to cloudHQ when Gmail loads.

Extract video playback link lets any HTTP(S) page trigger extension-privileged downloads for chosen URLs.

FPTU Move Out Class Tool sends a persistent client ID and timezone to a Cloudflare Workers tracking endpoint.

FRAK - Earn Money Watching YouTube sends YouTube watch-session details to FRAK reward APIs and Mixpanel.

Flagmoji sends flag emoji image requests from every page to flagmoji.lecaominhhn.workers.dev.

Flixsign Web PKI lets matching web pages send localStorage-derived signing commands to its local PKI native host.

Followers & Unfollowers sends Instagram profile and follower-list metrics to betaworkz.com analytics.

Forest Wallpaper sends top-site URLs from the new tab page to Google's favicon service.

Framer Checker sends the origins of detected Framer-built sites to script.cursodeframer.com.br.

Free Pocket Option Bot sends PocketOption account UIDs to 2bot.top during WebSocket balance updates.

TrackMailBox scans Gmail sent-folder rows and sends message metadata to its backend.

Free VPN | Fast Secure VPN - VPN Control sends public IP and VPN usage events to hdbest.fun.

GMB Page - CID & PlaceID Finder sends Google Maps business details from place pages to chrome.gothru.co.

Gemini Watermark Remover - Banana Clean sends a hashed device fingerprint to its trial-tracking server.

Gemini to PDF Saver exports Gemini chats to PDFs and uses a hardcoded local code to remove its watermark.

GenTech - Browser Tools retrieves the filtering username from filterstatus.com over cleartext HTTP.

GeoGuessr timer loads Google Fonts when its settings or saved-times pages open.

Get YouTube Transcript by CakeAI sends YouTube transcript contents and video metadata to cacheyoutubetranscript.totext.xyz.

Goin sends matched shopping page URLs and referrers to Mixpanel and Braze analytics.

GoodPlan stores encrypted notes locally using a passphrase shipped inside the extension bundle.

Goodhue sends selected and hovered image URLs to Goodhue-hosted services.

Google Account Easy Switch appends the selected Google account index to the active tab URL, even on non-Google sites.

Google Meet Attendance Tracker (new) stores participant names and IDs in Google Meet localStorage during tracking.

Grips sends visited domains to a CloudFront endpoint and posts active-tab page views to Google Analytics on extension clicks.

Haikyuu Wallpaper sends URLs from your browser's top sites to Google's favicon service on the new-tab page.

Hexomatic lets configured localhost pages overwrite stored authentication values used for its API calls.