Low risk browser extensions

RevenueHero lets any webpage trigger its onboarding flow and open the extension options page.

Reverbify injects Google Fonts into Spotify pages, causing Spotify visits to request fonts.googleapis.com.

Roblox Player Server Searcher lets URL fragments on Roblox game pages trigger a Roblox game join action.

Rust Search Extension loads Google Fonts and cdnjs stylesheets in its management pages.

SHub - Chong phat hien chuyen tab hides tab switches and focus loss from shub.edu.vn pages.

SP Formatter lets any website overwrite its extension settings through a page message.

Saja Boys with KPop Demon Hunters Live Wallpaper displays popup HTML fetched from api.gameograf.com on its new-tab page.

Save Grok Chat as PDF loads a Google Fonts stylesheet when it injects its export button on Grok pages.

ScamCheck sends each visited site origin to Scamadviser for reputation checks.

Screenshot to Notion & Annotate lets allowed MarkupHero or localhost pages capture any supplied URL and upload it.

Search Anything sends a base64-encoded extension profile to searchanything.co during install.

Search My Weather sends new-tab display and browser telemetry with persistent extension IDs to a usage endpoint.

Sechify injects extension image URLs into YouTube pages, making its installed extension ID visible to page scripts.

Shopee Chat Tuesday API Extension copies full page HTML from every HTTP and HTTPS site into its extension runtime.

Simple Mouse Gestures lets page-created mouse events trigger all-site gesture handlers that can close the active tab.

Simplicate embeds an OAuth client secret used when exchanging authorization codes for tokens.

Social Comments GPT fetches remote announcements and inserts them as HTML on supported social media pages.

Sonarr/Radarr/Lidarr autosearch puts configured Basic Auth credentials into media-site page links.

Speeder works with Paramount Plus sends Paramount+ account, subscription, and viewing data to me3x.online and metricsmint.quest.

SponsorKliks shows Chrome top-sites on its optional new-tab page and requests each site's favicon from Google.

Spotless: Spotify Ad Muter injects hidden browsebetter.io iframes into Spotify pages on first run and after use.

Spring Wallpaper sends Chrome top-sites URLs to Google's favicon service on its new-tab page.

Spy Guru sends extracted Facebook Ads Library entries and search keywords to app.spyguru.pro.

Steam Market History Cataloger stores your Steam Community session cookie in Chrome sync storage.

Steam TRY Converter embeds a RapidAPI key and sends it to currencyapi-net.p.rapidapi.com for Steam price conversion.

Stocks sends the current site's root domain to Yahoo Finance and posts portfolio form values to its telemetry endpoint.

Stranger Things 5 Live Wallpaper loads new-tab popups and shortcut links from api.gameograf.com.

Stray Kids Wallpaper New Tab sends top-site URLs to Google's favicon service on the new-tab page.

Stylar lets any webpage change its saved Stylar token and collection state through page messages.

Swiftin lets any embedding parent page trigger translation of a child frame, sending page text and title to api.swiftin.dev.

TG Downloader | Photos, Videos, Audios sends signed-in user profile details to Mixpanel from Telegram Web.

TabRevive lets any web page switch on its keep-alive page patches through a replayable postMessage bridge.

Tabloc lets locked tabs open attacker-chosen URLs from synthetic page clicks.

TeacherTab resolves your approximate location through IP geolocation services and sends coordinates to OpenWeather.

Team Analyzer for Pokemon Showdown sends default-enabled usage analytics to PostHog from supported Pokemon sites.

Tele on GPM Login removes page security headers from main-frame and sub-frame responses.

Telegram Downloader sends the active tab URL, public IP, and stored install identifiers to an Aliyun logging endpoint.

The wall - Boycott assistant sends a tracking pixel to the-wall.win when it displays an overlay on a flagged page.

TorBox Control sends hashes of supported download links on visited pages to TorBox cache-check APIs.

TransParrot sends YouTube watch page details and translation activity to Google Analytics.

TransferNow for Chrome and Gmail sends Gmail usage telemetry and errors with hashed Gmail identifiers to InboxSDK and Google endpoints.

Translate Image sends direct image page URLs and a persistent browser ID to Mixpanel.

True Captcha sends captcha images, page URLs, user agents, selector metadata, and saved API credentials to TrueCaptcha.

Tweet Copier sends selected X/Twitter tweet content and URLs to its vendor API for image, PDF, and usage logging.

Twitter Video Downloader sends default-on telemetry and settings snapshots to chromevideodownloader.com.

TypeOS lets webpages ask the extension to fetch an image and write it to your clipboard.

Unfollowers for Instagram & Insights stores Instagram cookie values from every top-level site it can access.

Unleash lets any website request that its browser side panel opens.

VModel's web-accessible remove-background page fetches a supplied URL and uploads the image to api.remaker.ai.

VPN99 sends bearer-token API calls to a fallback host supplied by its S3 configuration when the primary API fails.

VS Code Web reads the active tab URL on popup click and opens it through vscode.dev.

VStat 3 sends active tab hostnames to vstat.info and uses remote jobs to collect traffic data for selected domains.

Videozen: Screen and Camera Recorder accepts page messages on every site that open camera and microphone preview UI.

Vider Downloader opens randomized short.ovh ad pages when users click links or its download controls on Vider sites.

Vitamin TSETMC injects remote Vitamin code from vitamin-bourse.ir into TSETMC market-watch pages.

Vocal Remover runs on every site, modifies media CORS headers, and sends media-session telemetry when enabled.

Vocal Remover, Music Separator accepts external session tokens and sends them to api.unmix-app.com.

Volte for Randstad Foundation sends visited hostnames, Google result domains, and prompt URLs to app.volte.earth.

Vtop Captcha Solver sends VIT-domain visit counts and solve totals to hxfzcq.deta.dev every five visits.

WA Bulk Message Sender sends WhatsApp page telemetry and login/logout events to Google Analytics.