Low risk browser extensions

WA商务宝 sends WhatsApp Web page details and analytics IDs to Google Analytics.

Watch With Me lets pages query and control video playback inside cross-origin frames through postMessage handlers.

Weather may send your IP address to ip-api.com over cleartext HTTP when automatic location fallbacks run.

Weather Tab lets its remote new-tab frame request and receive your Chrome Top Sites list.

Web Page Reader TTS Text To Speech writes reader state and preferences into each page's web storage.

Whats the Font sends the current page URL to jigsaw.w3.org when validator mode is opened.

Word Counter stores the full URL of each newly active tab in Chrome sync storage.

WorldWeatherOnline embeds third-party weather and IP-location API credentials in its shipped JavaScript.

XMLDocReader sends IP addresses from land cadaster request rows to ipwho.is for geolocation lookup.

YouTube Comment Summary with ChatGPT OpenAI logs YouTube and ChatGPT UI actions with page URLs to an Aliyun logstore.

YouTube Keyboard Shortcuts Plus sends selected YouTube page text to Google or Weblio when lookup hotkeys are used.

YouTube Video Ad Downloader & Ad Data Export lets web pages change its AdsLibrary team state through page messages.

Youtube ad fast-forwarder sends YouTube video IDs, captions, timestamps, and descriptions to its Onrender server.

Zimbra Mail Notifier stores saved Zimbra passwords encrypted with a key derived from the public extension ID.

helloNFT collects Premint project page details and sends them to its backend.

iRivYou sends stored WooCommerce credentials and scraped review content to wooshark.website.

purple spotify injects a third-party Ko-fi image into open.spotify.com pages.

siriusxm app for pc,windows and Mac (Safe Download) embeds a RapidAPI key in its popup bundle.

zenVPN sends a fresh UUID to oopies8u.pages.dev when it enables the default proxy tunnel.

セカイブラウザ sends saved Sekai VPN credentials to any active proxy challenge without checking the proxy host.

The extension sends Ohmyzip API requests with a hardcoded chrome-app access token.

VK Next removes CSP on VK pages and rewrites CORS and origin headers for several cross-site requests.

UltimaDark modifies page security headers and stylesheet integrity checks while applying dark mode.

QuickDrag WE lets page-controlled frames trigger tab opens or downloads through its drag-and-drop handler.

WebNowPlaying lets any web page send media-control commands through its page message bridge.

goodie cashback lets any HTTPS page trigger cashback activation state and sends activation telemetry to goodie.pl.

Legacy Browser Support lets arbitrary websites invoke its browser-switcher flow for policy-matching URLs.

Infy Scroll can use remote database rules to disable service workers and clear site cache data on matched websites.

Feeder lets prepared web pages ask the extension to open tabs or redirect the current tab.

TrustBuilder Backup lets any website trigger a one-time reload of the current top-level page.

Spoof Timezone lets framed webbrowsertools.com pages persistently change the extension's timezone setting.

PJe+R disables page interaction and plays an external audio file for Russian-language users on RU, SU, and BY domains.

Screenshot Full Page fetches affiliate rules and rewrites or redirects merchant links on visited pages.

Squadrats Route Planning copies your Squadrats account UID into local storage on supported route-planner sites.

Simple Gesture for Android lets web pages trigger extension tab commands with synthetic gesture events.

BigGo Price History Shopping Assistant accepts webpage messages that can redirect tabs or submit coupons to BigGo.

Protect My Choices lets any website read the stored AdChoices preference string through its page message bridge.

Deadname Remover rewrites configured names in visited pages, making the replacement mapping visible to those sites.

Free YouTube Video Downloader sends entered video IDs to Google's API and opens a fixed third-party download page.

SN Utils accepts localhost WebSocket commands that can open tabs and run ServiceNow automation without authenticating the sender.

Dastyar Personal Assistant sends Google search queries to Dastyar SERP services.

TikNot sends TikTok short-link URLs to tikwm.com before redirecting you to its viewer.

Session Alive injects a page-readable extension audio resource into sites where a foreground timer runs.

YouTube Adblock injects a hidden iframe that requests noop.style after an eight-hour delay.

Audio Equalizer and Amplifier exposes saved equalizer settings to every HTTP(S) page it runs on.

Mobile Dyslexic exposes its extension runtime ID in the page DOM on every visited website.

AntiTestportal opens Testportal question text and image URLs in Google or DuckDuckGo searches when clicked.

Rewards loads its popup font stylesheet from Google Fonts over plaintext HTTP.

Better History NG loads favicons from sites shown in your browser history.

PDF editor PDFOffice sends visited tab URLs and a persistent extension ID to stream.redcoolmedia.net.

Shut Up: Comment Blocker stores hashed site hostnames when comments are toggled, including in private windows.

ASBPlayer creates a page-accessible subtitle frame that can forward AnkiConnect POSTs to localhost.

YouTube Downloader 2.0 sends visited site origins to cloud.sky4data.com and follows its tab-opening instructions.

Mes recettes de cuisine sends Google search keywords to tgcuisine.azurewebsites.net after a page-set consent flag is enabled.

one sec exposes its encoded extension runtime ID to every visited page.

Picodi.com Cashback batches recognized visited URLs with a stable installation ID and sends them to an AWS Lambda endpoint.

PDF Combine - Convert and Merge uploads user-selected files to online-convert.com when remote conversion is selected.

FC26 Enhancer sends Futnext account, EA persona, and entitlement details to PostHog analytics at g.futnext.com.

Cleanplaats Marktplaats filter stores marketplace listing IDs you view in local extension storage.

VHelper sends Amazon Vine listing details from Vine pages to its API servers.