Low risk browser extensions

YouTube Keyboard Shortcuts Plus sends selected YouTube page text to Google or Weblio when lookup hotkeys are used.

YouTube Video Ad Downloader & Ad Data Export lets web pages change its AdsLibrary team state through page messages.

Youtube ad fast-forwarder sends YouTube video IDs, captions, timestamps, and descriptions to its Onrender server.

Zimbra Mail Notifier stores saved Zimbra passwords encrypted with a key derived from the public extension ID.

Ziplyne POC Player accepts authentication messages from any site and uses the stored token for Ziplyne API telemetry.

helloNFT collects Premint project page details and sends them to its backend.

iRivYou sends stored WooCommerce credentials and scraped review content to wooshark.website.

purple spotify injects a third-party Ko-fi image into open.spotify.com pages.

siriusxm app for pc,windows and Mac (Safe Download) embeds a RapidAPI key in its popup bundle.

zenVPN sends a fresh UUID to oopies8u.pages.dev when it enables the default proxy tunnel.

Вернуть 1080 и 1440 на Twitch redirects Twitch HLS playlist requests to app.clifl.com with the original query string.

セカイブラウザ sends saved Sekai VPN credentials to any active proxy challenge without checking the proxy host.

The extension sends Ohmyzip API requests with a hardcoded chrome-app access token.

QuickDrag WE lets page-controlled frames trigger tab opens or downloads through its drag-and-drop handler.

cat-catch-re-tiktok records media request URLs and selected headers across sites, including cookies and authorization headers when present.

BigGo Price History Shopping Assistant accepts webpage messages that can redirect tabs or submit coupons to BigGo.

UltimaDark modifies page security headers and stylesheet integrity checks while applying dark mode.

Screenshot Full Page fetches affiliate rules and rewrites or redirects merchant links on visited pages.

PJe+R disables page interaction and plays an external audio file for Russian-language users on RU, SU, and BY domains.

Twitter File Downloader sends download-count and traffic-usage statistics to MediaHarvest servers.

Simple Gesture for Android lets web pages trigger extension tab commands with synthetic gesture events.

Red Shield VPN sends a per-install device code in DNS-over-HTTPS TXT lookups to public resolvers.

Feeder lets prepared web pages ask the extension to open tabs or redirect the current tab.

goodie cashback lets any HTTPS page trigger cashback activation state and sends activation telemetry to goodie.pl.

WebNowPlaying lets any web page send media-control commands through its page message bridge.

Lettres et CVs sends Google search queries and extension identifiers to lettres-gratuites.azurewebsites.net after consent.

Infy Scroll can use remote database rules to disable service workers and clear site cache data on matched websites.

Free YouTube Video Downloader sends entered video IDs to Google's API and opens a fixed third-party download page.

Spoof Timezone lets framed webbrowsertools.com pages persistently change the extension's timezone setting.

SN Utils accepts localhost WebSocket commands that can open tabs and run ServiceNow automation without authenticating the sender.

TikNot sends TikTok short-link URLs to tikwm.com before redirecting you to its viewer.

Deadname Remover rewrites configured names in visited pages, making the replacement mapping visible to those sites.

GeoSpoof lets webpages disable its in-page WebRTC protection before probing IP candidates.

VK Next removes CSP on VK pages and rewrites CORS and origin headers for several cross-site requests.

Pinterest Dark Theme loads popup stylesheets from Google Fonts and cdnjs when its toolbar popup opens.

Session Alive injects a page-readable extension audio resource into sites where a foreground timer runs.

Rewards loads its popup font stylesheet from Google Fonts over plaintext HTTP.

YouTube Adblock injects a hidden iframe that requests noop.style after an eight-hour delay.

ChatGPT in Sidebar loads third-party stylesheets when its options page opens.

YouTube Downloader 2.0 sends visited site origins to cloud.sky4data.com and follows its tab-opening instructions.

Shut Up: Comment Blocker stores hashed site hostnames when comments are toggled, including in private windows.

Squadrats Route Planning copies your Squadrats account UID into local storage on supported route-planner sites.

Mes recettes de cuisine sends Google search keywords to tgcuisine.azurewebsites.net after a page-set consent flag is enabled.

Coloriage Plus sends a persistent extension ID and install timestamp to coloriage.azurewebsites.net on Google searches.

Picodi.com Cashback batches recognized visited URLs with a stable installation ID and sends them to an AWS Lambda endpoint.

Mobile Dyslexic exposes its extension runtime ID in the page DOM on every visited website.

Better History NG loads favicons from sites shown in your browser history.

Audio Equalizer and Amplifier exposes saved equalizer settings to every HTTP(S) page it runs on.

BlockDistraction - Block Site Extension sets an uninstall URL with encoded usage and subscription details.

VHelper sends Amazon Vine listing details from Vine pages to its API servers.

PDF editor PDFOffice sends visited tab URLs and a persistent extension ID to stream.redcoolmedia.net.

ASBPlayer creates a page-accessible subtitle frame that can forward AnkiConnect POSTs to localhost.

AntiTestportal opens Testportal question text and image URLs in Google or DuckDuckGo searches when clicked.

Dastyar Personal Assistant sends Google search queries to Dastyar SERP services.

PDF Combine - Convert and Merge uploads user-selected files to online-convert.com when remote conversion is selected.

Dark theme for VK fetches remote settings that can insert iframes into VK pages and pass conversation IDs in the iframe URL.

one sec exposes its encoded extension runtime ID to every visited page.

AwardWallet sends checkout details and browsing paths around selected pages to awardwallet.com when remote settings enable tracking.

NZBDonkey accepts nzblnk link clicks from any webpage and can submit resulting NZBs to configured targets.

Level up for Dynamics 365/Power Apps accepts page messages from any website and opens extension result tabs with their content.