Low risk browser extensions

Arsenal FC Wallpapers renders remote Gameograf content inside its new-tab page.

Art Institute of Chicago: Art Tab sends new-tab page-view telemetry with a persistent client ID to Google Analytics.

Asistente WIRD sends a persistent client UUID and hashed signed-in email address to Google Analytics.

Ask Ben sends your chat prompts to OpenAI and requests your public IP address from ipinfo.io when the popup loads.

Ask Every AI removes frame security headers from every subframe response it can access.

Asset Store Price Tracker rewrites some Unity Asset Store package URLs to add affiliate tracking parameters.

Aston Martin F1 Cars Wallpapers loads new-tab shortcuts and popup HTML from api.gameograf.com.

Astronomy Picture of the Day APOD sends Chrome top-sites URLs to Google's favicon service on new tabs.

Auto HD for YouTube loads remote stylesheet resources when its popup or help page opens.

Auto Max Quality Pro sends YouTube quality-change events with page details and a persistent client ID to Google Analytics.

Auto Scope Fr sends parsed vehicle listing details to Supabase from supported marketplace listing pages.

AutoGPT sends ChatGPT account and page telemetry to Google Analytics.

Automatic TWITTER Translator sends X/Twitter tweet and message text to translation services, including cleartext pro API requests.

Autumn Wallpaper sends new-tab top-site URLs to Google's favicon service.

Avengers Heroes Live Wallpaper sends user-added shortcut URLs to Google's favicon service.

Avengers Live Wallpaper inserts Gameograf-supplied popup and shortcut content into its new-tab page.

BERTHA AI exposes its image downloader to any page and inserts a Chrome profile email hash into page DOM.

BTC Fee Now sends a bundled Etherscan API key to Etherscan when loading Ethereum gas fees.

Backrooms Unblocked embeds a GameJolt private API key in its game bundle.

Bananablet sends Habblet account identifiers to api.bananablet.dev after login or game identity parsing.

Bandcamp Scrobbler embeds Last.fm API credentials and sends signed scrobble/session requests to Last.fm.

Barcode Maze sends popup page-view metadata and a persistent client ID to Google Analytics.

Basic Gestures lets any webpage trigger its close-tab gesture and close the active tab.

Batman Runner Game loads an unencrypted third-party advertising iframe when its game page opens.

Beach & Ocean Sunset Wallpaper sends top-site domains from its new-tab page to Google's favicon service.

Begin: Bitcoin Cardano Wallet ships production API keys and service credentials in its extension bundle.

Best Smooth Jazz loads its radio stream over cleartext HTTP.

BetterVLR sends Twitter/X status IDs from VLR forum posts to a Fly.io service for tweet embeds.

BetterWASYA sends signed-in WASD profile details and channel viewing relationships to its service endpoints.

BiLin lets any webpage change its saved translation and assistant settings through a CustomEvent bridge.

Bionic Text Converter sends the active frame URL to the Bionic Reading RapidAPI endpoint when you convert a page.

BirdTab sends new-tab usage and settings analytics to PostHog.

Bisma - Prayer Times sends typed city names and geolocation coordinates to Google Maps for geocoding.

Black Bugatti Live Wallpaper New Tab sends shortcut URLs to Google's favicon service when rendering the new-tab page.

Black Panther Bugatti Live Wallpaper sends new-tab shortcut URLs to Google's favicon service.

Black Wallpaper sends up to 10 top visited site URLs to Google's favicon service on the new-tab page.

Bleach Wallpaper sends top-visited site URLs to Google's favicon service on its new-tab page.

Block Ctrl W lets any website query its content script and receive an active-extension status response.

Blooket Hacker Pro fetches remote settings that control a full-page overlay and iframe on Blooket pages.

Blue Lock Wallpaper sends Chrome top-site URLs to Google's favicon service on the new tab page.

BlurSafe for WhatsApp loads Google Fonts and Ko-fi resources in its popup, sending request metadata to those services.

PageOrg captures each visited page's URL, text, and HTML preview into its local history cache.

Bootstrap grid viewer loads Font Awesome from use.fontawesome.com when its popup opens.

BrainyTab fetches new-tab categories and page content from cms.brainytab.com using a bundled bearer token.

Brawl Stars Wallpaper sends top visited site URLs to Google's favicon service on its new tab page.

Broadcast extension includes a hardcoded Azure Functions key for license-store function requests.

Budgey reads checkout totals and coupon codes on configured shop pages and sends coupon telemetry to stat.smartshopping.ai.

Bugatti Wallpaper sends URLs from Chrome's top sites list to Google's favicon service on its new-tab page.

Bulk Contact Saver for WhatsApp sends your WhatsApp phone number to an AWS Lambda activation endpoint.

Bulk Email Reply by cloudHQ sends Gmail account addresses and account-switcher emails to cloudHQ.

Bungo Stray Dogs Wallpaper sends your most-visited site URLs to Google's favicon service on each new-tab page.

Business Click to Call Axialys lets websites trigger its Axialys click-to-call popup with a phone number.

ByteSeal sends visited page origins from its all-sites content script to mapping.byteseal.net.

B站问号榜 sends the current Bilibili video ID and DedeUserID cookie value to bili-qml.bydfk.com.

CANVO - Advanced Image Editor opens an install page that embeds a remote HTTP iframe from canv3app.chrome-app-ext.online.

CFCA CertEnrollment.Hebgyl Extension lets allowed websites choose a native messaging host and send arbitrary JSON to it.

CFCA CryptoKit.HANABANK Extension lets allowed Hana Bank pages send payloads to a selected native messaging host.

CFCA CryptoKit.sge Extension lets allowed SGE sites choose a native messaging host and send it funcInfo messages.

CFCA SecEditCtl.HANA Extension lets HanaBank pages relay messages to a native messaging host.

CFCA SecEditCtlAdv.ICBC Extension lets ICBC web pages send caller-controlled messages to its native bridge.