Low risk browser extensions

Block YouTube Shorts stores request headers sent to ChatGPT, including authentication-bearing headers.

Branalyzer Brand's Instant Analyzer ships backend API access codes in its extension bundle.

Bunny & Rabbit Wallpaper sends your new-tab top-site URLs to Google's favicon service.

CFCA CertEnrollment.YOCYL Extension lets allowlisted websites choose a native messaging host and relay messages through it.

CFCA CryptoKit.Induschain Extension lets allowed websites send selected payloads to a local native-messaging host.

CFCA CryptoKit.NCB Extension lets approved NCB web origins choose a native messaging host and forward payloads to it.

CFCA CryptoKit.YOCYL Extension lets many allowed websites choose and message a native application.

CS2 Float Checker ships a static SteamLedger API token used for its backend extension endpoints.

Capture by Tracker stores Tracker login credentials in reversible base64 and reuses them for Tracker API requests.

Capybara Live Wallpaper loads Google Fonts and sends user-added shortcut domains to Google's favicon service.

Cat wallpaper sends precise location coordinates to OpenWeatherMap for its new-tab weather widget.

ChatGPT & Gemini File Uploader sends ChatGPT profile details to fileuploader.app and page views to Google Analytics.

ChatGPT Sidebar Assistant sends install telemetry with IP metadata and a persistent UUID to Alibaba Cloud logging.

Chess Free Online sends a persistent user identifier and app visit details to bot.izibit.net when the game opens.

Christmas Decorations Wallpaper New Tab sends your Chrome top-sites URLs to Google's favicon service.

Christmas Tree in Town Live Wallpaper inserts remote Gameograf popup HTML into its new-tab page.

Chrome Auto Refresh loads a remote Font Awesome stylesheet when its popup opens.

Cinnamoroll Cursor exposes part of its extension runtime ID in every webpage via an injected style class.

CiteMaker CiteWeb loads a StatCounter tracking pixel from its popup over cleartext HTTP.

CityU Quick Course Adder loads its popup stylesheet from jsDelivr when the extension popup opens.

Classic Games for Chrome loads Playtik game iframes from any webpage where a user opens a game.

ClipType inserts typing controls that load button icons from img.icons8.com on the active page.

Clown Wallet lets any website make the extension send an eth_chainId POST to a wallet RPC URL before approval.

Cnfans + rewrites CnFans product URLs to the author's affiliate ref code 37818.

CoCites [Beta] sends Google Scholar result titles to NCBI E-utilities to find matching PubMed IDs.

Cobalt lets allowlisted websites read its full local wallet storage through external messages.

CoinTool - MetaSafe accepts page messages that can approve its wallet-warning dialog.

Colada DevTools stores page-posted Colada debugging payloads in the extension's local browser storage.

Color Picker loads Google Fonts from its popup, sending a request to Google when the extension UI opens.

ConcertPal removes Ticketmaster framing protections to load hidden pages and reuse the tmpt cookie.

WhatsApp Contact Exporter sends WhatsApp Web page telemetry to Google Analytics.

Couponuts checks visited site domains with app.indoleads.com to find coupon offers.

Coursera Summary with ChatGPT and Take Notes signs NoteGPT API requests from bundled extension credentials.

Cronofy lets Gmail pages request the stored Cronofy scheduler auth token from the extension.

Crypto Price Checker sends currency conversion requests with an embedded RapidAPI key to a RapidAPI fixer endpoint.

Currency Exchange Rate embeds an Open Exchange Rates API key in its popup code.

D1CryptExt Native Messaging Host lets scoped local-domain pages send messages to its native host.

Daily Wallpaper Changer injects GitHub-controlled CSS into matching HTTP/S pages based on each page URL.

Dailymotion Dual Subtitles mirrors subtitle translation messages to Amplitude with video URLs, titles, and subtitle text.

Danni's Hattrick Helper copies its OAuth token from extension storage into readable page cookies on Hattrick pages.

Data Studio Companion loads a Google Fonts stylesheet into Looker Studio pages when obfuscation mode is enabled.

DealCatcher sends opened overlay page URLs and coupon-related search queries to its analytics and lookup endpoints.

DeepSeek Open SideBar in Chrome removes anti-framing and content-security headers on DeepSeek and Google pages.

DeleteNonio deletes first-party cookies when a page URL contains a monitored news-domain substring.

Demon Slayer Kimetsu no Yaiba Wallpaper sends top-sites URLs to Google's favicon service on its new-tab page.

Demon Slayer Mugen Train Wallpaper sends Most Visited site URLs to Google's favicon service.

Demon Slayer Tanjiro Wallpaper sends top-sites URLs to Google's favicon service on each new tab.

Discord Exporter copies your Discord login token into a page-readable body attribute on discord.com.

Discord Token Login writes a URL-supplied value into Discord localStorage as the session token.

Documate OCR lets any installed extension open it and pass image blobs into its OCR interface.

Dork Filtertron loads popup CSS and button mask assets from Cloudflare cdnjs and GitHub raw content when its popup opens.

Double Click Image Downloader starts image downloads from pages when matching image click events occur.

DraStic DS Emulator Apk PC [Guide] fetches remote settings that can open first-run tabs and set popup content.

DragIt! lets page scripts trigger its drag-and-drop handler to open an attacker-chosen URL in a new tab.

Dragon Ball Super Wallpaper sends your most visited site URLs to Google's favicon service on the new tab page.

Dragon Ball Z Live Wallpaper inserts Gameograf popup HTML into its new-tab page.

Dragon Ball Z Wallpaper sends your most-visited site URLs to Google's favicon service on the new tab page.

Draw on Screen lets page scripts request a privileged screenshot download after its drawing mode is enabled.

Drop a GIF modifies WhatsApp Web's content security policy so it can inject its GIF-sharing scripts.

Duration for Google Tasks sends pageview and autocapture telemetry from Google Calendar and Tasks pages to PostHog.