Low risk browser extensions

Cat wallpaper sends precise location coordinates to OpenWeatherMap for its new-tab weather widget.

The extension sends persistent export-usage totals to a Supabase endpoint when DeepSeek loads.

ChatGPT & Gemini File Uploader sends ChatGPT profile details to fileuploader.app and page views to Google Analytics.

ChatGPT Sidebar Assistant sends install telemetry with IP metadata and a persistent UUID to Alibaba Cloud logging.

Chess Free Online sends a persistent user identifier and app visit details to bot.izibit.net when the game opens.

Christmas Decorations Wallpaper New Tab sends your Chrome top-sites URLs to Google's favicon service.

Christmas Tree in Town Live Wallpaper inserts remote Gameograf popup HTML into its new-tab page.

Chrome Auto Refresh loads a remote Font Awesome stylesheet when its popup opens.

Chrome Reload All Tabs lets any web page click its injected widget to reload browser tabs.

Cinnamoroll Cursor exposes part of its extension runtime ID in every webpage via an injected style class.

CiteMaker CiteWeb loads a StatCounter tracking pixel from its popup over cleartext HTTP.

CityU Quick Course Adder loads its popup stylesheet from jsDelivr when the extension popup opens.

Classic Games for Chrome loads Playtik game iframes from any webpage where a user opens a game.

ClipType inserts typing controls that load button icons from img.icons8.com on the active page.

Clown Wallet lets any website make the extension send an eth_chainId POST to a wallet RPC URL before approval.

Cnfans + rewrites CnFans product URLs to the author's affiliate ref code 37818.

CoCites [Beta] sends Google Scholar result titles to NCBI E-utilities to find matching PubMed IDs.

Cobalt lets allowlisted websites read its full local wallet storage through external messages.

CoinTool - MetaSafe accepts page messages that can approve its wallet-warning dialog.

Colada DevTools stores page-posted Colada debugging payloads in the extension's local browser storage.

Color Picker loads Google Fonts from its popup, sending a request to Google when the extension UI opens.

ConcertPal removes Ticketmaster framing protections to load hidden pages and reuse the tmpt cookie.

WhatsApp Contact Exporter sends WhatsApp Web page telemetry to Google Analytics.

Couponuts checks visited site domains with app.indoleads.com to find coupon offers.

Coursera Summary with ChatGPT and Take Notes signs NoteGPT API requests from bundled extension credentials.

Cristiano Ronaldo Insane Jump Live Wallpaper inserts unsanitized remote popup HTML into its new-tab page.

Cronofy lets Gmail pages request the stored Cronofy scheduler auth token from the extension.

Crypto Price Checker sends currency conversion requests with an embedded RapidAPI key to a RapidAPI fixer endpoint.

Currency Exchange Rate embeds an Open Exchange Rates API key in its popup code.

D1CryptExt Native Messaging Host lets scoped local-domain pages send messages to its native host.

Daily Wallpaper Changer injects GitHub-controlled CSS into matching HTTP/S pages based on each page URL.

Dailymotion Dual Subtitles mirrors subtitle translation messages to Amplitude with video URLs, titles, and subtitle text.

Danni's Hattrick Helper copies its OAuth token from extension storage into readable page cookies on Hattrick pages.

Data Studio Companion loads a Google Fonts stylesheet into Looker Studio pages when obfuscation mode is enabled.

DealCatcher sends opened overlay page URLs and coupon-related search queries to its analytics and lookup endpoints.

Deep Enrich sends LinkedIn profile URLs to app.deepenrich.com before its consent dialog is accepted.

DeepSeek Open SideBar in Chrome removes anti-framing and content-security headers on DeepSeek and Google pages.

DeleteNonio deletes first-party cookies when a page URL contains a monitored news-domain substring.

Demon Slayer Kimetsu no Yaiba Wallpaper sends top-sites URLs to Google's favicon service on its new-tab page.

Demon Slayer Mugen Train Wallpaper sends Most Visited site URLs to Google's favicon service.

Demon Slayer Tanjiro Wallpaper sends top-sites URLs to Google's favicon service on each new tab.

Dimensions requests a Font Awesome stylesheet from cdnjs.cloudflare.com when its popup opens.

Discord Exporter copies your Discord login token into a page-readable body attribute on discord.com.

Discord Token Login writes a URL-supplied value into Discord localStorage as the session token.

Documate OCR lets any installed extension open it and pass image blobs into its OCR interface.

Dork Filtertron loads popup CSS and button mask assets from Cloudflare cdnjs and GitHub raw content when its popup opens.

Double Click Image Downloader starts image downloads from pages when matching image click events occur.

DraStic DS Emulator Apk PC [Guide] fetches remote settings that can open first-run tabs and set popup content.

DragIt! lets page scripts trigger its drag-and-drop handler to open an attacker-chosen URL in a new tab.

Dragon Ball Super Wallpaper sends your most visited site URLs to Google's favicon service on the new tab page.

Dragon Ball Z Live Wallpaper inserts Gameograf popup HTML into its new-tab page.

Dragon Ball Z Wallpaper sends your most-visited site URLs to Google's favicon service on the new tab page.

Draw on Screen lets page scripts request a privileged screenshot download after its drawing mode is enabled.

Drop a GIF modifies WhatsApp Web's content security policy so it can inject its GIF-sharing scripts.

Duration for Google Tasks sends pageview and autocapture telemetry from Google Calendar and Tasks pages to PostHog.

Döviz ve Altın Kurları posts built-in Altinkaynak SOAP credentials to an HTTP data service when its popup loads.

E Money Network exposes its persistent analytics ID and install timestamp to any website through its wallet bridge.

EH Assistant Tool for Shopee sends your Shopee account ID to licensing.ehict.com during page setup.

ENHYPEN Current Wallpapers New Tab sends Chrome topSites URLs to Google's favicon service.

ESUIT Anti Popup Comments for Facebook removes Content-Security-Policy headers on Facebook and esuit pages.