Low risk browser extensions

Pinterest Video Downloader Plus&Data Export lets any website trigger account refresh, workspace switch, or logout actions.

Pinterest extra loads on every website and sends page-derived link IDs to Pinterest when it finds Pinterest-like lists.

Picture In Picture for Pluto TV [QVI] sends Pluto profiles, bookmarks, continue-watching, and playback event data to metricmuse.xyz.

Podsmaster - Podcast Aggregator includes PodcastIndex API credentials in its packaged JavaScript.

Porsche 911 GT3 RS Power live Wallpaper sends shortcut URLs to Google's favicon service on each new-tab render.

Portal Nacional Plus sends invoice export details and license identifiers to its Supabase credit service.

PostFox - Export IG Posts requests selected Instagram avatar URLs through igcdn.extensionsfox.com during export setup.

PrivateVPN stores remembered login credentials with reversible encryption using a hardcoded key.

Promptmatic ships a commented Promptmatic access key and workspace identifiers beside its API request code.

PubSpy.io sends active tab domains to its lookup worker and uploads discovered AdSense domain rows to pubspy.io.

Publisher Debug lets any website ask the extension to open a URL in a new tab.

Pullquote sends each visited page's hostname to statdb.blogads.com from its broad content script.

Puppies & Dogs Cursor injects a site-visible cursor style marker into every webpage.

Pusheen Wallpaper New Tab sends top-sites URLs to Google when rendering its most-visited shortcut list.

Q-Stats injects Google Fonts stylesheets into Quora question pages, causing requests to fonts.googleapis.com.

Qshot - Bullet Search removes framing and isolation headers from configured subframes on any web page.

Quizplus sends Google search terms and clicked result details to quizplus.com with a persistent client ID.

Rabet lets any website query whether the wallet is unlocked through its injected page bridge.

Radial New Tab's floating search can be driven by page scripts to open and submit prompts to ChatGPT.

Rate My Professor Extension sends instructor link clicks with persistent IDs to Google Analytics.

Realtime Content Insights records Google Analytics beacon URLs, page titles, and event fields from visited sites.

Recipe Cart reads recipe details from matched pages and sends the page URL and recipe content to api.getrecipecart.com.

Recruiters' integration tool sends saved candidate profile HTML and URLs to CleverStaff.

Rengoku Live Wallpaper New Tab fetches popup HTML from api.gameograf.com and renders it in the new tab page.

Responsive Image Linter can send the clicked page's URL and responsive-image details to any embedded frame on that page.

Right Click Opens Link in a Background Tab lets page scripts trigger background tabs to attacker-chosen links.

Roblox Friend Manager shows a review prompt on non-Roblox pages after enough extension use.

The extension accepts forged page messages that can add HTML to its Roll20 book and chat UI.

Rozsirenie KUPLIO sends coupon outcome and checkout total analytics to CityAds when coupon auto-apply runs.

RussianGram sends selected text, nearby page context, and active-page text to russiangram.com for language features.

SAT Control Stage lets matching satiniappcliente.asp pages send commands to its native messaging host.

SEO Extension ROSSK writes user-agent spoofing settings into each visited site's localStorage.

SF Explorer sends extension page-view telemetry, including full extension page URLs, to Google Analytics.

SRM Margin Check sends a stable Mixpanel identifier from SRM student portal pages to api.mixpanel.com.

SSFeatures identifies the logged-in Smartsheet user to PostHog with an email hash and display name.

SVODEX sends streaming watch-page URLs, episode IDs, and viewing progress to filmtoro.com.

Satisfying Clicks loads Google Fonts stylesheets in its popup and welcome page.

Save to Pinterest adds your Pinterest user ID to Pinterest conversion requests made from any website.

SaveSora exposes Sora request headers to page scripts and lets them replay requests with those headers.

Scan Profit accepts storefront page messages that can trigger authenticated product lookups to app.scanprofit.com.

Screen and Audio Capture Extension loads remote popup resources from Cloudflare and Buy Me A Coffee.

Script Injector lets any website request saved script-injection entries from extension storage.

Sender sends the user's WhatsApp number or WhatsApp localStorage data to Google Analytics.

SensCritique sends streaming-page URLs, referrers, and viewed title identifiers to Datadog logs.

The extension loads exchange-rate content from www.safirmedya.com over HTTP when its popup opens.

Shared Music reads your Google Meet account email and sends it through cors.deno.dev to api.sharedmusic.app.

ShopSavvy lets webpages send messages that open background tabs or save caller-supplied sign-in data.

Side Browser | Open page in side panel removes CSP and X-Frame-Options headers from framed and top-level pages.

Sidebar Tabs removes CSP and X-Frame-Options headers from all sites while loading user-entered pages in its side panel.

Signnet Bridge Proxy forwards portal page fetch and XHR requests to local Signnet services on localhost.

Simple Private Bookmark encrypts stored bookmarks and lock password with a hardcoded passphrase included in the extension.

Smart Bookmark Companion extension downloads EasyList cosmetic rules and injects matching CSS on Google pages.

Smart Tribune Extension can send the active tab's page text to Smart Tribune's hosted side-panel frame.

Smodin lets parent pages message its all-frame content script to replace text inside framed editors.

Snapchat Wallpaper sends your top-site URLs to Google's favicon service when opening its new-tab page.

Snooze Email by cloudHQ sends Gmail account and account-switcher email addresses to cloudHQ during Gmail setup.

Social media blocker replaces supported social-media pages with a banner image loaded from i.ibb.co.

Something Awful Last Read Redux can replace Vine links with embedded Vine content on forum thread pages.

Sonatype Platform Browser Extension sends supported package-page URLs and parsed package identities to Google Analytics.

Space Galaxy Wallpaper sends top-sites URLs to Google's favicon service on the new-tab page.