Low risk browser extensions

HTML5 Video Everywhere reports supported-site injection counters to api.admin.tik.tn after version changes.

Shodan.io (DEPRECATED) sends each visited website hostname to Shodan lookup APIs.

Password Depot Extension forwards WebAuthn create/get requests from any site to its native Password Depot host.

Cleanplaats Marktplaats filter stores marketplace listing IDs you view in local extension storage.

Sticky Notes embeds an OAuth client secret and sends it to its token endpoint during login.

Easy RSS requests Google favicons for feed domains shown with unread entries.

Extended Color Management exposes its color-management state to every website you visit.

MONKNOW New Tab sends your public IP address to ip-api.com during automatic weather location setup.

Surfingkeys lets any web page send editor commands through its native Neovim bridge.

Sorftime Save sends captured Shopee marketplace API responses and Seller Center identifiers to Sorftime servers.

Banglar Bhumi Auto Captcha injects affiliate price-check links on Amazon and Flipkart product pages.

MYNT: Material You New Tab asks ipinfo.io for an IP-based location and sends the resulting coordinates to WeatherAPI.

Google Dark Theme loads a Flaticon image from Google pages where its injected dark-theme CSS matches.

Netflix Bilingual Subtitles exposes its stored user token to scripts running on Netflix pages.

AutoTube renders status and update messages fetched from appstatus.netlify.app inside its popup.

Foxtana Pro rewrites Bing search URLs to a chosen search engine and forces custom search redirects to HTTP.

Selectext: Copy Text from Videos sends the current page URL to embedded frames and lets page messages write clipboard content.

Ratepunk sends full hotel booking-confirmation page HTML to its troubleshooting endpoint when cashback data is missing.

Secret Server Utilities for Firefox lets any website send page-chosen text to the system clipboard.

Better Battlelog Fix(BBLog) runs update JavaScript from irussao.github.io on Battlelog pages.

Ai Chat everywhere removes browser history entries for AI services when its background script runs.

WebGL Fingerprint Defender lets webpages trigger its desktop fingerprinting notification.

Megabonus - cash back up to 40% sends shopping-page analytics labels and its extension UUID to Google Analytics.

Scam Blocker sends clicked HTTP and HTTPS links to PCMatic for risk checks.

Soundgasm Downloader sends Soundgasm page details and author link lists to an AWS API.

VirusTotal Scan sends context-menu link URLs to VirusTotal with an embedded API key.

AliPrice Price Tracker reports matched AliExpress and Tmall browsing URLs to AliPrice statistics.

Gooding Erinnerungsfunktion lets any web page change the selected Gooding project stored by the extension.

Transmitter for Transmission lets any website ask the extension to add a torrent to the configured server.

ShortsBlocker rewrites Amazon product URLs to add its affiliate tag when Amazon pages load.

Live Start Page sends history-derived top-site hostnames to everhelper.pro during first-install speed-dial setup.

Rebrandly sends the active tab URL and title to api.rebrandly.com when you create a short link.

vToad New Tab Page sends Firefox and Opera top-site domains to Google's favicon service for shortcut icons.

はてなブックマーク ブックマーク機能 reports each visited HTTP or HTTPS page URL to Hatena's bookmark API.

Pinned Google Drive sets marvelsearch.com as the default search provider, sending browser search queries there.

Duolingo Max modifies Duolingo scripts and profile responses to show paid features and unlimited hearts.

Reminder | Refunder exposes its extension ID and version to every website it runs on.

Quick Screenshot fetches remote affiliate rules and rewrites or redirects merchant pages on visited sites.

Ad-BlockerPro injects a pcvark promotional iframe into HTTP and HTTPS pages you visit.

AutoPagerize Advanced fetches a plaintext wedata.net rule feed that controls automatic next-page loading and insertion.

Stream Bypass accepts media URLs in its web-accessible player and makes extension-origin requests to them.

Lettres Gratuites sends a letter-template search match flag from Google searches to lettres-gratuites.azurewebsites.net.

Google Redirects Fixer & Tracking Remover rewrites matching Google redirect subresource requests into current-tab navigations.

Netflix Party fetches remote rules that can open hidden tabs and click configured page elements.

Content Farm Terminator exposes a web-accessible sandbox that makes credentialed fetches to caller-supplied URLs.

TablissNG contacts Giphy with its bundled API key when the Giphy background provider is used.

Ant.com Antmark manager add-on sends each active HTTP(S) tab URL to Ant.com when you switch or update tabs.

Super History & Cache Cleaner lets any webpage trigger its floating clear button to erase configured browsing data.

Furigana converts Japanese page text into parsed HTML, so page text containing markup can become live DOM elements.

BetterRYM embeds Spotify, Discogs, and YouTube API credentials in its shipped RateYourMusic content script.

PDFify Pro & Search sends install-time telemetry with user and attribution IDs to api.pdfifyproapp.com.

SponsorBlock for Spotify sends Spotify playback skip telemetry to sponsor.ajay.app, including in private windows by default.

Ahoy! reports blocked main-frame page URLs to its API when it detects Portuguese ISP block pages.

Python Notebook Viewer executes JavaScript and HTML embedded in local .ipynb output cells.

GamersClub Booster can send lobby links, player details, and match server credentials to a user-configured webhook.

MagicalDownloader lets any HTTP(S) page send media URLs to its background downloader through a page-message bridge.

Gladiatus Crazy Add On exposes its extension identifier to Gladiatus page scripts.

Right Links WE lets web pages trigger extension-created tabs or windows for page-chosen links.

eSnipe Snipe Tool loads remote settings from snipetool.esnipe.com and uses them to add scriptable buttons to eBay pages.

Minimal Consent sends each active site's host and cookie-consent details with a persistent device UUID to its Cloud Functions endpoint.