Low risk browser extensions

Auvik SaaS Management reads your entire browser history and reports every login you make to its backend.

DICOM viewer extension relays unvalidated page events to browser APIs, letting any website trigger native host calls and tab control.

Jabra ChromeHost relays arbitrary web page messages to a native host controlling Jabra device state, without origin validation.

Softdreams công cụ ký điện tử exposes a hardware-token signing bridge to any web page without enforcing an origin allowlist.

Toolbox for Google Play Store sends Google Play package names to APKMirror to check app availability.

e-Dnevnik Plus sends e-Dnevnik page and school/class details to Google Analytics.

Popup Blocker (strict) intercepts and blocks popup and tab-open requests on every page, presenting a confirmation UI that any page script can inject fake entries into.

Ruffle - Flash Emulator runs Flash content locally via WebAssembly and does not send browsing data to external servers.

Hoxx VPN Proxy sends proxy error URLs and user IDs to its API servers and fetches its server list from unsigned public CDN buckets.

FranceVerif - Sécurité en ligne lets any page ask its content script for the stored FranceVerif user UUID.

Music Mode for YouTube stores its extension ID in YouTube pages' sessionStorage.

On Disney+, the extension sends your account details and watch history to its own servers.

SocialFocus fetches server-controlled CSS selectors from untrap.app and applies them to social media pages without integrity validation.

Symantec Authentication Client Extension relays PKI commands from any web page to a locally installed native messaging host.

Tile Tabs WE injects a quick menu that HTTP/HTTPS pages can click to trigger tab, window, and bookmark actions.

UpSeller captures product page HTML and Shopee authentication headers from e-commerce tabs and transmits them to app.upseller.com.

The extension reads a remotely selected UID cookie and sends its suffix to union.we2.com.

WebNowPlaying lets any website subscribe to active media metadata and send media-control commands through a page message bridge.

Who Deleted Me reads Facebook friend-list pages and can send truncated sync response bodies to its logging service.

Zight accepts login tokens from any local file without verifying the sender and sends your account email to a third-party analytics service.

Bilibili Video Download Helper resolves your public IP and sends a per-user telemetry record to an Alibaba Cloud logging service on downloads.

Windscribe routes browser traffic through its VPN proxy and injects content scripts on all pages to block ads, trackers, and spoof geolocation.

Package Tracking Tab installs Yahoo Search with affiliate codes as the default search engine without disclosing the commercial arrangement.

Tabliss - New Tab sends browser error reports including user-agent and extension page URL to Sentry's error monitoring service.

BotRix fetches shop data from botrix.live and inserts item names and prices into YouTube and Trovo page HTML.

ClickFix Block detects and blocks ClickFix social-engineering prompts on most web pages, and exposes its settings to any page via an open external-messaging channel.

Devolutions Workspace reads form fields on every page to autofill saved logins, and ships hardcoded credentials for its telemetry server.

FlowCrypt ships a hardcoded Google OAuth client secret in its extension bundle.

Maps Scraper transmits scraped Bing Maps business data to its servers for server-side email and social media profile extraction.

Night Shift adds a page element whose class includes its Chrome extension ID on every top-level website.

Page Auto Refresh sends a persistent UUID and session ID to Google Analytics on startup and every 60 minutes.

RoSearcher replaces Roblox purchase buttons with RoEarn install prompts for signed-in users.

SimpRead can import a user-supplied 'third-party rule source' and runs expressions from those rules against the pages you read.

SimpleLogin by Proton lets any page trigger alias creation and read the generated alias from its email input.

Sourcegraph loads Google Fonts CSS when adding its interface to GitHub pages.

SuperPiP sends visited page URLs, titles, and referrers to Google Analytics after vendor provisioning.

TON Wallet injects a wallet provider into every page that can return the logged-in TON address and balance.

TTV NoAds sends the current Twitch channel name to a blocktwitchads proxy when ad-tagged playlists trigger fallback.

Free VPN Proxy & Ad Blocker - Planet VPN redirects your current tab to an advertiser link after login or a server switch on free accounts.

Turn Off the Lights for Firefox dims video backgrounds and injects night-mode styles across all pages, with a link-click handler that lets any visited page overwrite the extension's color settings.

Citavi Picker sends OAI publication identifiers to CORE when searching for downloadable PDFs.

Simple Tab Groups lets web pages trigger configured tab-group hotkeys with synthetic key events.

SetupVPN sends device fingerprint and account UID to anonymous proxy servers and fetches its server list from unsigned CDN mirrors.

Avira Browser Safety transmits every visited URL to Avira's classification API and can execute server-supplied JavaScript on shopping sites.

AT Price Tracker reads the user's signed-in Google account email and sends it with every scraped vehicle listing to its own servers.

Ban Checker for Steam sends Steam IDs and an API key to Steam's GetPlayerBans API to check player ban status.

Calendar Dark Mode can load Google Fonts when its optional monospace font add-on is enabled.

Canvas+ sends its settings and install metadata to a Google Forms survey after a user clicks the survey prompt.

Clari Groove reads the content of Gmail emails and Google Calendar events and sends them to its backend to log activity in Salesforce.

EuroSaver sends the Amazon marketplace country from product pages to eurosaver.net for banner selection.

Gleas CertImporter PKI bridges certificate and token operations on vendor PKI pages to a locally installed native app via native messaging.

Minesweeper Original sends a UUID-based identifier to Google Analytics every 60 minutes while the browser is running.

NotebookLM Extension - ExtendLM sends a persistent anonymous UUID to Google Analytics on every extension interaction.

SFL fetches remote search-provider rules and uses them to redirect address-bar search queries.

Save to Collect sends the active tab URL and page title to WeTransfer's Collect API when the user triggers a save.

Search Safety sends install telemetry to Lavasoft and loads each new tab through mynewtab.co with install details.

Skribbl.io Cheats fetches a word list from a third-party npoint.io bucket on every skribbl.io page load and displays clickable word hints based on the current round's letter pattern.