Low risk browser extensions

NZBDonkey accepts nzblnk link clicks from any webpage and can submit resulting NZBs to configured targets.

Old Twitter Layout (2026) posts Twitter/X API responses and CSRF-bearing headers to page-window listeners.

SoftNet WebSign lets any /eCorpoNet/ page send messages to the SignNet native messaging host.

OK.ru Downloader (IDL Helper) has no confirmed data-recipient findings in the available review data.

Level up for Dynamics 365/Power Apps accepts page messages from any website and opens extension result tabs with their content.

Dark theme for VK fetches remote settings that can insert iframes into VK pages and pass conversation IDs in the iframe URL.

xPrice sends visited merchant URLs and product page details to xprice.ro.

AwardWallet sends checkout details and browsing paths around selected pages to awardwallet.com when remote settings enable tracking.

FicLab sends downloaded-story metadata and source URLs to www.ficlab.com after successful ebook downloads.

TMDB Player stores a bundled TMDB API token and sends it to api.themoviedb.org when fetching TV details.

Recettes Cooking sends Google search queries and stored identifiers to epicurien.azurewebsites.net.

vToad New Tab Page sends Firefox and Opera top-site domains to Google's favicon service for shortcut icons.

1688 Chat Tuesday API Extension reads full page HTML from every HTTP and HTTPS site after the page loads.

2TOOL - Auto Mời GROUP trên facebook starts Facebook group invites from a URL flag on group pages.

55PBX Web Softphone opens its webphone page when any site sends it a same-page message.

720 - No USD (V5) lets any visited page use hidden DOM commands to open, focus, navigate, or close extension windows.

AAWP loads a remote logo image from cdn.getaawp.com when its extension pages open.

ABlock replaces selected websites with a developer-supplied warning overlay.

AI Image Prompter fetches GitHub-hosted feature JSON and inserts its prompts, captions, titles, and images into AI-site pages.

AI to Human Text initializes Amplitude session replay that can send popup and expand-page DOM activity to Amplitude.

APTEAN AI (PREVIEW) sends scoped page metadata and selected text to Aptean's AI assistant iframe.

Academics lets any website set API auth state that later feeds requests to addons.ebibliophil.ro.

Ad Skip for YouTube writes its extension ID and base URL into YouTube pages.

Ad-Blocking - YouTube & Websites sends visited page URLs, referrers, and page links to service.allblock.app.

AdLib Pro sends Facebook Ad Library creative IDs to monitoring.svc.extention.site even when its reach-fetching switch is disabled.

Adena trusts page-supplied origin fields, letting websites impersonate connected dApps for account access and approval prompts.

Adventure Time Wallpaper sends top visited site URLs to Google's favicon service on its new-tab page.

Agent Warning Remover & Quick Buy rewrites supported shopping-agent URLs to use the extension author's affiliate codes.

AiPrice Search by Image for Walmart can silently reroute your clicks on Walmart product links through its own affiliate-tracking redirect.

AiPrice reports matched browsing URLs to api.aliprice.com based on remote rules.

AliExpress AdBlocker and Booster sends a persistent user ID and tab-count state to user.addon-analytic.com.

AliExpress Parcels - My Orders injects jQuery from code.jquery.com into AliExpress Russia order pages.

Amazon Chat Tuesday API Extension reads and sends the full HTML of every HTTP and HTTPS page after an 8 second delay.

Amazon Price Tracker Extension routes opened tracked Amazon products through softmate.club with product details in the URL.

Amazon Review Scraper sends a stored TurtleTasks username to its access-check API with an embedded API key.

Amazon SiteStripe Alternative loads a developer-hosted image beacon when its popup opens on Amazon pages.

Anime Car Drift Live Wallpaper - JDM Racing New Tab Wallpaper sends custom shortcut URLs to Google's favicon service.

AnyTab Laser Pointer sends usage counters to leadsandconversion.com and loads galileoconsulting.ee on every page.

Anytime Wherever loads Google Fonts on its new tab page, sending each new-tab request to fonts.googleapis.com.

Apple TV Speeder sends Apple TV viewing, subscription, and account profile data to metricmuse.xyz and metricsmint.quest.

Arcrawls posts AI chat prompts and page text into the page window on all sites.

AskCuddy sends selected page text and user-selected screenshots to its API with a stored customer ID.

Audio Booster for Amazon Prime [QVI] sends Prime Video profiles, history, bookmarks, subscriptions, and contact details to remote servers.

Audio Booster for HBO Max [QVI] sends Max viewing history and profile data to me3x.online and metricsmint.quest.

Auto side preview strips site framing and request-origin headers while opening search-result previews.

AutoMOT exposes an iframe that lets any website trigger its MOT backend lookups using extension storage/auth context.

KeyCorrect treats password fields as autocorrect targets and can save typed password-field words in local extension storage.

Automatic zalo translator sends Zalo message text to its translation API over cleartext HTTP.

BMW M4 Live Wallpaper inserts remote popup HTML from api.gameograf.com into its new-tab page.

BTC Ticker sends configured market symbols to allcrypto.info over a plaintext ticker socket.

Banggood Price Tracker's content script accepts commands from a spoofed sender field instead of verifying the message's real origin.

Better goSupermodel sends your goSupermodel account ID to its Vercel API once per day.

Black Panther Wallpaper sends up to 10 top-visited page URLs to Google's favicon service on its new tab page.

Blackjack loads popup styles from cdnjs and Google Fonts when you open it.

Blackpink Wallpaper sends top-site URLs from its new-tab page to Google's favicon service.

Block YouTube Shorts stores request headers sent to ChatGPT, including authentication-bearing headers.

Branalyzer Brand's Instant Analyzer ships backend API access codes in its extension bundle.

Bunny & Rabbit Wallpaper sends your new-tab top-site URLs to Google's favicon service.

CFCA CertEnrollment.YOCYL Extension lets allowlisted websites choose a native messaging host and relay messages through it.

CFCA CryptoKit.Induschain Extension lets allowed websites send selected payloads to a local native-messaging host.