Low risk browser extensions

FranceVerif - Sécurité en ligne lets any page ask its content script for the stored FranceVerif user UUID.

Music Mode for YouTube stores its extension ID in YouTube pages' sessionStorage.

SimpleLogin by Proton lets any page trigger alias creation and read the generated alias from its email input.

Symantec Authentication Client Extension relays PKI commands from any web page to a locally installed native messaging host.

Tile Tabs WE injects a quick menu that HTTP/HTTPS pages can click to trigger tab, window, and bookmark actions.

UpSeller captures product page HTML and Shopee authentication headers from e-commerce tabs and transmits them to app.upseller.com.

Who Deleted Me reads Facebook friend-list pages and can send truncated sync response bodies to its logging service.

Zight accepts login tokens from any local file without verifying the sender and sends your account email to a third-party analytics service.

Bilibili Video Download Helper resolves your public IP and sends a per-user telemetry record to an Alibaba Cloud logging service on downloads.

Windscribe routes browser traffic through its VPN proxy and injects content scripts on all pages to block ads, trackers, and spoof geolocation.

Tabliss - New Tab sends browser error reports including user-agent and extension page URL to Sentry's error monitoring service.

Package Tracking Tab installs Yahoo Search with affiliate codes as the default search engine without disclosing the commercial arrangement.

BotRix fetches shop data from botrix.live and inserts item names and prices into YouTube and Trovo page HTML.

FlowCrypt ships a hardcoded Google OAuth client secret in its extension bundle.

Maps Scraper transmits scraped Bing Maps business data to its servers for server-side email and social media profile extraction.

Night Shift adds a page element whose class includes its Chrome extension ID on every top-level website.

RoSearcher replaces Roblox purchase buttons with RoEarn install prompts for signed-in users.

SocialFocus fetches server-controlled CSS selectors from untrap.app and applies them to social media pages without integrity validation.

TTV NoAds sends the current Twitch channel name to a blocktwitchads proxy when ad-tagged playlists trigger fallback.

The extension reads a remotely selected UID cookie and sends its suffix to union.we2.com.

WebNowPlaying lets any website subscribe to active media metadata and send media-control commands through a page message bridge.

Turn Off the Lights for Firefox dims video backgrounds and injects night-mode styles across all pages, with a link-click handler that lets any visited page overwrite the extension's color settings.

Free VPN Proxy & Ad Blocker - Planet VPN redirects your current tab to an advertiser link after login or a server switch on free accounts.

Simple Tab Groups lets web pages trigger configured tab-group hotkeys with synthetic key events.

Citavi Picker sends OAI publication identifiers to CORE when searching for downloadable PDFs.

SetupVPN sends device fingerprint and account UID to anonymous proxy servers and fetches its server list from unsigned CDN mirrors.

Avira Browser Safety transmits every visited URL to Avira's classification API and can execute server-supplied JavaScript on shopping sites.

AT Price Tracker reads the user's signed-in Google account email and sends it with every scraped vehicle listing to its own servers.

Ban Checker for Steam sends Steam IDs and an API key to Steam's GetPlayerBans API to check player ban status.

Calendar Dark Mode can load Google Fonts when its optional monospace font add-on is enabled.

Canvas+ sends its settings and install metadata to a Google Forms survey after a user clicks the survey prompt.

Clari Groove reads the content of Gmail emails and Google Calendar events and sends them to its backend to log activity in Salesforce.

ClickFix Block detects and blocks ClickFix social-engineering prompts on most web pages, and exposes its settings to any page via an open external-messaging channel.

EuroSaver sends the Amazon marketplace country from product pages to eurosaver.net for banner selection.

Gleas CertImporter PKI bridges certificate and token operations on vendor PKI pages to a locally installed native app via native messaging.

Molly sends visited URLs and a device fingerprint to api.molly.gratis and injects the user's JWT token into pages on partner sites.

NotebookLM Extension - ExtendLM sends a persistent anonymous UUID to Google Analytics on every extension interaction.

Page Auto Refresh sends a persistent UUID and session ID to Google Analytics on startup and every 60 minutes.

SFL fetches remote search-provider rules and uses them to redirect address-bar search queries.

Save to Collect sends the active tab URL and page title to WeTransfer's Collect API when the user triggers a save.

Search Safety sends install telemetry to Lavasoft and loads each new tab through mynewtab.co with install details.

Sourcegraph loads Google Fonts CSS when adding its interface to GitHub pages.

SuperPiP sends visited page URLs, titles, and referrers to Google Analytics after vendor provisioning.

Unblocked Games — New Tab sends top-site and bookmark URLs to gamestabs.com for favicon loading.

Unsplash Instant assigns each user a persistent UUID and transmits it to Google Analytics on every new tab open.

XB block all ads sends the current tab URL and browser details to AdGuard when users submit a website report.

Yeastar Linkus for Google connects to a user-configured PBX and transmits diagnostic logs containing usernames and extension numbers to it.

Livdub sends the domain of every page you dub, a persistent install ID, and session details to its own telemetry server.

VaSaham fetches Tehran Stock Exchange market data over plaintext HTTP from tsetmc.com and a set of hardcoded raw-IP mirror hosts.

Watch2Gether is a co-viewing extension that lets users share and watch videos together on w2g.tv.

Chrome Mask fetches a Chrome version number from a third-party server and injects it into request headers on user-whitelisted sites.

Vue.js devtools is a browser developer tool that inspects Vue.js applications running on the current page.

Evernote Web Clipper embeds a hardcoded HMAC secret in its bundle and accepts UI-trigger messages from any web origin.

Metric Unit Converter & Search replaces the default search engine with a Bing affiliate URL on install.

Download Manager (S3) modifies Content-Security-Policy headers on every page and can send downloaded file hashes to VirusTotal.

Turbo Download Manager accepts download commands from any other installed Firefox extension without validating the sender's identity.

Bittorent For Chrome sends your saved uTorrent Web UI password as a Basic-Auth header over plain HTTP and to message-supplied URLs.

Block Websites Focus Timer sends usage metrics and a persistent device ID to Amplitude's EU analytics servers.