Low risk browser extensions

Worldview embeds an ArcGIS access token and sends map coordinates to ArcGIS services for geocoding and suggestions.

YouNow Screen Share Extension lets YouNow pages and HTTPS localhost pages request screen-sharing source IDs.

YouTube Ads Silencer loads Google Fonts from remote Google endpoints when its popup opens.

YouTube Audio Selector shares stored language preferences with pages on YouTube.

YouTube Enhancer copies the saved YouTube Data API key into page-readable DOM on YouTube pages.

YouTube Music Hotkeys loads a GitHub-hosted image from its options page when shortcut settings are opened.

Youtube Mix to Shareable Playlist sends YouTube mix conversion counts and playlist type to PostHog.

Youtube Music Together sends host track metadata from YouTube Music rooms to music.eraycan.com.

Youtube Right Side Comments loads popup fonts and stylesheets from Google Fonts and BootstrapCDN.

YoutubePreamp loads Google Fonts and a GitLab image while injecting its YouTube interface.

ZenUML Sequence loads Google Fonts from its extension workspace, sending extension-use network metadata to Google.

The extension sends visible Mercado Livre listing IDs and marketplace metadata to its backend.

avatar maker from photo reports app visits with a persistent browser-synced UUID to bot.izibit.net.

close_tab(s) lets webpage-triggered injected controls close the current tab or neighboring tabs.

dScribe Data contacts dScribe APIs from HTTPS pages outside dScribe when you are signed in.

find-your-product-on-meesho injects a Meesho inventory banner controlled by GitHub JSON and tracks banner events with Mixpanel.

fnaf 4 online sends a persistent extension UUID and game or notification interaction events to yoki.games.

fontSwap sends extension error reports that can include the current tab URL to a Cloudflare Worker.

gn-math loads its game page HTML and scripts from jsDelivr when the extension page opens.

iDocCar Helper sends downloaded PDFs and document uploads to iDocCar's OCR API with a bundled API key.

iTop VPN checks your public IP through cleartext IP-location services when its popup opens.

ip8.com extension answers matching website messages with its Chrome extension ID on HTTPS pages.

mei's lens lets any page trigger extension-privileged downloads after its lens UI is activated.

notionClipper exposes its AI summary iframe so web pages can send prompts through the user's ChatGPT session.

oneClipper exposes a hardcoded Google Gemini API key in a web-accessible clipping script.

pFinTools.com sends active tab URLs to Google Analytics and can report Amazon product-page details to Google Apps Script.

scale.jobs sends active job-page URLs and extracted job details from its side panel to api.scale.jobs.

uSuperDrag lets any webpage open an attacker-chosen tab through simulated drag-and-drop events.

VPN for Twitter X loads remote proxy configuration and uses bundled proxy credentials to route Twitter/X traffic.

ВПН для Ютуба bundles proxy usernames and passwords in its extension package.

✔️ ส่วนขยาย IDM can let any web page trigger extension-privileged downloads for image URLs.

纳米AI助手 sends page URLs and titles with a persistent extension UID to 360 analytics when its assistant UI appears.

讯飞星火：每个人的AI助理 sends the first 100 characters of page text from HTTP(S) pages to Xunfei's servers.

購有錢-比價賺現金小幫手 records a rolling local history of full URLs from top-frame browsing.

速卖通选品助手 exposes a message bridge that lets localhost pages read cookies and proxy browser requests.

Old Twitter Layout (2026) posts Twitter/X API responses and CSRF-bearing headers to page-window listeners.

FicLab sends downloaded-story metadata and source URLs to www.ficlab.com after successful ebook downloads.

FC26 Enhancer sends Futnext account, EA persona, and entitlement details to PostHog analytics at g.futnext.com.

Yandex Wordstat Assistant stores saved keyword phrases and counts in Yandex Wordstat page storage.

Protect My Choices lets any website read the stored AdChoices preference string through its page message bridge.

xPrice sends visited merchant URLs and product page details to xprice.ro.

OK.ru Downloader (IDL Helper) has no confirmed data-recipient findings in the available review data.

SoftNet WebSign lets any /eCorpoNet/ page send messages to the SignNet native messaging host.

Youtube AgeRestriction Unblocker rewrites YouTube watch URLs to open matching nsfwyoutube.com pages over HTTP.

YouTube Downloader Plus removes frame-blocking and content-security headers from every page response.

Download Dailymotion videos sends persistent install and runtime metadata to pbion.com telemetry.

TMDB Player stores a bundled TMDB API token and sends it to api.themoviedb.org when fetching TV details.

Ban Checker for Steam sends Steam Web API keys to api.steampowered.com when checking ban status.

Enkrypt exposes wallet settings, including its analytics UUID, to web pages through its injected bridge.

TrustBuilder Backup lets any website trigger a one-time reload of the current top-level page.

BILD - Bundesliga-News & Ergebnisse sends stored BILD consent strings to Sport BILD's video stream service.

Flickr Size Pickr injects Flickr API image URLs into the active Flickr tab without escaping them.

Ready Wallet injects an in-page bridge on every site and exposes its extension ID in the page DOM.

Smart Image Downloader injects a page script on every site that can decrypt and run code supplied through page meta tags.

Viking Deals sends error reports from its all-sites content script with stored account id and email attached.

Viewstats records YouTube viewing and interaction events and sends them to api.viewstats.com.

I'm not robot captcha clicker automatically clicks visible Google reCAPTCHA checkboxes in pages you visit.

Recettes Cooking sends Google search queries and stored identifiers to epicurien.azurewebsites.net.

dataslayer lets any website turn off its analytics-request blocking rule through a page message.

YouTube Video Downloader - For Context Menu rewrites matching page links through affiliate URLs fetched over HTTP.