Low risk browser extensions

e-Dnevnik Plus sends e-Dnevnik page and school/class details to Google Analytics.

Turn Off the Lights for Firefox dims video backgrounds and injects night-mode styles across all pages, with a link-click handler that lets any visited page overwrite the extension's color settings.

Simple Tab Groups lets web pages trigger configured tab-group hotkeys with synthetic key events.

Free VPN Proxy & Ad Blocker - Planet VPN redirects your current tab to an advertiser link after login or a server switch on free accounts.

Avira Browser Safety transmits every visited URL to Avira's classification API and can execute server-supplied JavaScript on shopping sites.

AT Price Tracker reads the user's signed-in Google account email and sends it with every scraped vehicle listing to its own servers.

Ban Checker for Steam sends Steam IDs and an API key to Steam's GetPlayerBans API to check player ban status.

Calendar Dark Mode can load Google Fonts when its optional monospace font add-on is enabled.

Canvas+ sends its settings and install metadata to a Google Forms survey after a user clicks the survey prompt.

Clari Groove reads the content of Gmail emails and Google Calendar events and sends them to its backend to log activity in Salesforce.

ClickFix Block detects and blocks ClickFix social-engineering prompts on most web pages, and exposes its settings to any page via an open external-messaging channel.

Gleas CertImporter PKI bridges certificate and token operations on vendor PKI pages to a locally installed native app via native messaging.

Maps Scraper transmits scraped Bing Maps business data to its servers for server-side email and social media profile extraction.

NotebookLM Extension - ExtendLM sends a persistent anonymous UUID to Google Analytics on every extension interaction.

Page Auto Refresh sends a persistent UUID and session ID to Google Analytics on startup and every 60 minutes.

Relingo runs on every page and sends words and sentences you select to its own API and to third-party dictionary and translation services.

SFL fetches remote search-provider rules and uses them to redirect address-bar search queries.

Save to Collect sends the active tab URL and page title to WeTransfer's Collect API when the user triggers a save.

Search Safety sends install telemetry to Lavasoft and loads each new tab through mynewtab.co with install details.

Smart Mute sends extension lifecycle and settings events to Google Analytics using an embedded API secret.

SuperPiP sends visited page URLs, titles, and referrers to Google Analytics after vendor provisioning.

XB block all ads sends the current tab URL and browser details to AdGuard when users submit a website report.

Livdub sends the domain of every page you dub, a persistent install ID, and session details to its own telemetry server.

VaSaham fetches Tehran Stock Exchange market data over plaintext HTTP from tsetmc.com and a set of hardcoded raw-IP mirror hosts.

SetupVPN sends device fingerprint and account UID to anonymous proxy servers and fetches its server list from unsigned CDN mirrors.

Citavi Picker sends OAI publication identifiers to CORE when searching for downloadable PDFs.

Watch2Gether is a co-viewing extension that lets users share and watch videos together on w2g.tv.

Vue.js devtools is a browser developer tool that inspects Vue.js applications running on the current page.

Evernote Web Clipper embeds a hardcoded HMAC secret in its bundle and accepts UI-trigger messages from any web origin.

Chrome Mask fetches a Chrome version number from a third-party server and injects it into request headers on user-whitelisted sites.

Metric Unit Converter & Search replaces the default search engine with a Bing affiliate URL on install.

Download Manager (S3) modifies Content-Security-Policy headers on every page and can send downloaded file hashes to VirusTotal.

Bittorent For Chrome sends your saved uTorrent Web UI password as a Basic-Auth header over plain HTTP and to message-supplied URLs.

Block Websites Focus Timer sends usage metrics and a persistent device ID to Amplitude's EU analytics servers.

CFCA CertEnrollment bridges ADBC bank pages to a local native application for certificate-based authentication.

CFCA CryptoKit.ADBC bridges pages on adbc.com.cn and hellotech.top to a locally installed bank PKI/certificate app via native messaging.

Capturables exposes a persistent install identifier to every visited page.

Capture to a Gif sends the hostname of the page you record to Google Analytics on each GIF or PNG capture, tied to a persistent install ID.

CoffeTab replaces your new-tab page with a meta-refresh that immediately redirects every new tab to coffetab.com.

Convert Picture to Text runs Tesseract OCR locally in the browser, fetching language model files from an external CDN when processing images.

CyberGhost Cookie Cleaner sends domains shown in its exceptions UI to Google's favicon service.

GA4 Debugger reads GTM dataLayer events on every visited page and displays them in a DevTools panel.

Dolby Voice 1.3 exposes a postMessage bridge on all pages that allows any web page to relay messages to the native Dolby Voice application.

I'm a Gentleman lets any visited page trigger downloads of image URLs through synthetic click or drag events.

I'm not robot captcha clicker auto-clicks the Google reCAPTCHA "I'm not a robot" checkbox for you whenever one appears.

MP3 Converter & Downloader sends an extension-generated UUID to Google Analytics over HTTP.

Minesweeper Original sends a UUID-based identifier to Google Analytics every 60 minutes while the browser is running.

Minimal Theme for Twitter / X sends user-clicked Twitter/X draft text to Typefully in a new URL.

MyIPCam sends activation codes to myipcamapp.net over unencrypted HTTP and contains a hardcoded offline bypass key.

Outsurf downloads shortcut rules from outsurf.net and redirects matching Google searches to configured destinations.

Quidco Cashback Reminder tracks every URL visited against 4,847 merchant domains and sends interaction events with a persistent UUID to Google Analytics.

SEO Extension by Mangools sends the current tab URL to Google PageSpeed and Rollbar using hardcoded API keys embedded in the extension.

Salesforce DevTools embeds a hardcoded OAuth client secret in its source that any user can extract from the CRX file.

Skribbl.io Cheats fetches a word list from a third-party npoint.io bucket on every skribbl.io page load and displays clickable word hints based on the current round's letter pattern.

Synapse Pathology Workflow Extension lets matching HTTPS pages control its dual-screen workflow windows.

Text to Speech TTS AI | Readvox sends TTS failure telemetry with page text and URL details to Google Analytics.

UI5 Inspector lets page scripts trigger injection of extension-packaged scripts into the active tab.

Unblocked Games — New Tab sends top-site and bookmark URLs to gamestabs.com for favicon loading.

Unsplash Instant assigns each user a persistent UUID and transmits it to Google Analytics on every new tab open.

The extension reads a remotely selected UID cookie and sends its suffix to union.we2.com.