Low risk browser extensions

Picture in Picture YouTube contacts picturepip.com on install or update and opens a server-controlled URL in a new tab.

Porn / Adult Blocker, Block Sites - BlockerX sends blocked page URLs and blocking reasons to Mixpanel analytics.

QR Code (Generator and Reader) sends generated QR content to short-link services and online decode requests to qrcd.org.

Reader Mode sends the current page URL to readermode.io when it loads an article for signed-in users.

Redirect Blocker accepts page-created shortcut key events that toggle blocking for the current tab or all tabs.

Rewardsweb uses Rewardsweb and LATAM Pass endpoints for cashback/OAuth flows and Google Analytics for analytics.

SmartProxy loads an AvaProxy favicon from avaproxy.com when its settings page opens.

SmoothScroll lets child frames send messages that scroll the top page.

This extension boosts browser audio volume and adds deep bass controls for online media.

Speech Translator exposes an embeddable popup that starts speech recognition and sends transcripts to Google Translate.

Spell Checker for Chrome sends text you check to external spelling services.

Synology Image Assistant Extension exposes a native-messaging file-upload bridge to any web page via an unguarded postMessage handler.

Tab for a Cause routes each new tab through http://tab.gladly.io/newtab/ before any HTTPS redirect.

TransOver lets any webpage trigger Google Translate requests and read returned translations from its injected popup.

Twitch Channel Points Auto Clicker loads a remote ravenbtw.com badge image in some Twitch chat messages.

This extension helps overseas users access web services in mainland China.

WAPI FREE - Jaguar sends WhatsApp Web page details and engagement events to Google Analytics.

Weblioポップアップ英和辞典 sends hovered or selected page text to Weblio's quote API for popup dictionary results.

Yellow Search sends default-search queries to yellow-search.com with a server-issued UID.

coffeelings loads third-party font and image assets when its popup opens.

nico downloader mirrors its settings and NicoNico dictionary resume markers into page-origin localStorage.

The app attaches a persistent per-install token to every request its game webview makes, including third-party ad requests.

Hide Youtube-Shorts loads Google Fonts when its extension popup opens.

AI Blaze briefly injects a script tag on every page that carries the extension's ID in a readable DOM attribute.

Auvik SaaS Management reads your entire browser history and reports every login you make to its backend.

Calculator app sends popup usage and license-flow events to Google Analytics.

Jabra ChromeHost relays arbitrary web page messages to a native host controlling Jabra device state, without origin validation.

Music Mode for YouTube stores its extension ID in YouTube pages' sessionStorage.

Toolbox for Google Play Store sends Google Play package names to APKMirror to check app availability.

Shows browser notifications for new email across configured mailboxes.

Auto Tab Discard exposes a real-time form-input indicator on the page window to all scripts on every website visited.

ImTranslator sends selected text from any webpage to its own servers for translation and text-to-speech processing.

BTRoblox ships a hardcoded ButterCMS API token in its extension bundle used to fetch blog content.

Adaptive Tab Bar Color reads the active tab's page theme and applies matching colors to the Firefox browser chrome.

Connective signing extension lets any website ask its local signer app for GET_INFO details and read the response.

Popup Blocker (strict) intercepts and blocks popup and tab-open requests on every page, presenting a confirmation UI that any page script can inject fake entries into.

DICOM viewer extension relays unvalidated page events to browser APIs, letting any website trigger native host calls and tab control.

FranceVerif - Sécurité en ligne lets any page ask its content script for the stored FranceVerif user UUID.

SimpleLogin by Proton lets any page trigger alias creation and read the generated alias from its email input.

Symantec Authentication Client Extension relays PKI commands from any web page to a locally installed native messaging host.

Tile Tabs WE injects a quick menu that HTTP/HTTPS pages can click to trigger tab, window, and bookmark actions.

Zight accepts login tokens from any local file without verifying the sender and sends your account email to a third-party analytics service.

Hoxx VPN Proxy sends proxy error URLs and user IDs to its API servers and fetches its server list from unsigned public CDN buckets.

Ruffle - Flash Emulator runs Flash content locally via WebAssembly and does not send browsing data to external servers.

Windscribe routes browser traffic through its VPN proxy and injects content scripts on all pages to block ads, trackers, and spoof geolocation.

Converter Suite sets Yahoo as the default search engine and routes all searches through an undisclosed affiliate tracking account.

Package Tracking Tab installs Yahoo Search with affiliate codes as the default search engine without disclosing the commercial arrangement.

Tabliss - New Tab sends browser error reports including user-agent and extension page URL to Sentry's error monitoring service.

Manuals Explorer replaces the browser's default search engine with Yahoo Search via affiliate tracking parameters on install.

BotRix fetches shop data from botrix.live and inserts item names and prices into YouTube and Trovo page HTML.

FlowCrypt ships a hardcoded Google OAuth client secret in its extension bundle.

Night Shift adds a page element whose class includes its Chrome extension ID on every top-level website.

RoSearcher replaces Roblox purchase buttons with RoEarn install prompts for signed-in users.

SocialFocus fetches server-controlled CSS selectors from untrap.app and applies them to social media pages without integrity validation.

Sourcegraph loads Google Fonts CSS when adding its interface to GitHub pages.

TTV NoAds sends the current Twitch channel name to a blocktwitchads proxy when ad-tagged playlists trigger fallback.

UpSeller captures product page HTML and Shopee authentication headers from e-commerce tabs and transmits them to app.upseller.com.

WebNowPlaying lets any website subscribe to active media metadata and send media-control commands through a page message bridge.

Who Deleted Me reads Facebook friend-list pages and can send truncated sync response bodies to its logging service.

Bilibili Video Download Helper resolves your public IP and sends a per-user telemetry record to an Alibaba Cloud logging service on downloads.