Low risk browser extensions

CNFans helper - RepCartel rewrites CNFans product URLs to use its referral ID.

CRX Downloader & Reviews Exporter sends download and review-export telemetry with a persistent extension UUID to Alibaba Log Service.

CSV Editor lets any web page make it open and fetch a page-controlled CSV URL with extension permissions.

CU Internet Auto Login saves CU portal credentials locally to automate sign-ins.

Call of Duty Black Ops 6 Live Wallpaper sends shortcut domains to Google's favicon service on the new-tab page.

Call of Duty Ghost Live Wallpaper sends user-added new tab shortcut URLs to Google for favicon images.

CallCloud sends user/event telemetry to Discord webhooks and identifies HubSpot callers in LogRocket.

Canva Automate copies your Genby token into Canva page localStorage where Canva scripts can read it.

CanvasCape loads FontAwesome resources from ka-f.fontawesome.com when launched on the active page.

CapCut Template opens the publisher site on install and again after monthly background checks.

CaptchaAI - Captcha Solver sends page URLs and captcha challenge details to CaptchaAI for solving.

CasperDash lets any site request the wallet public key and connected-site map through its injected page bridge.

Caucasus Auto Tool sends Copart and IAAI lot identifiers from auction pages to api.apicar.store.

Cede.store lets connected web pages ask the extension to open a tab and inject its helper script.

ChadGuard sends blocked or AI-flagged page URLs and a Discord username to chadguard.pythonanywhere.com.

Chain.fm loads a chain.fm iframe on enabled trading sites and sends the current hostname to Chain.fm.

ChartsTab checks visited sites with chat-secreto.es and can redirect tabs with the hostname and full URL in the redirect.

Chat GPT Diagram sends PlantUML code blocks from ChatGPT pages to plantuml.com for diagram rendering.

ChatGPT Speed Booster copies extension membership details into ChatGPT page localStorage.

ChatGPT for Google Calendar bundles recoverable shared OpenAI and Gemini API keys for fallback AI requests.

ChatGPT for StackOverflow sends StackOverflow question page visits and page metadata to Mixpanel.

ChatGPT for Web Search loads remote jQuery on its sandboxed new-tab search page.

ChatGpt Россия fetches remote proxy rules that can route selected browsing destinations through its configured proxy.

ChatSider sends active tab URLs, IP-derived location, and a persistent UUID to an Aliyun logstore.

Chibi Nezuko Kamado Pink Heart Anime Live Wallpaper sends saved shortcut URLs to Google's favicon service.

Chick Movie Ratings and Suggestions sends Google search movie titles, URLs, and locale metadata to Google Analytics.

Christmas Tree Wallpaper New Tab sends top-site URLs to Google's favicon service on each new-tab load.

ChromaTube posts its extension runtime ID into YouTube pages when its content script starts.

Chrome Cloudflare Helper inserts a GitHub-hosted badge image on Cloudflare pages, sending image-request metadata to GitHub.

Cinnamoroll Aesthetic Live Wallpaper loads Google Fonts resources whenever its new-tab page opens.

Clarity notes V2 returns stored access and refresh tokens to its approved web and localhost origins.

ClassInTheBox has no confirmed reviewed data-sharing behavior recorded in this scanner.

Claude Helper loads Google Fonts on claude.ai pages, sending page request context to Google font endpoints.

Clear all tabs lets any webpage trigger its injected widget to ask the extension to close other open tabs.

Click switch socks5 records page resource hostnames and saves proxy-routing domain relationships locally.

Click to Copy injects a copy toolbar into every website and places extension asset URLs in the page DOM.

ClipHutch monitors media requests and stores request headers used to fetch detected videos and images.

CloudDrive助手 disables page interaction and plays remote audio for Russian-language users on RU/SU/BY domains.

CoTik captures Shopee and Rebuy request headers and writes them into page localStorage.

Codeforces Custom Contests accepts cross-origin messages that create Codeforces gym contests from supplied problem and invite data.

Color Picker Dropper loads a remote placeholder image when its popup opens.

Color Pocket loads Google Tag Manager in its popup and sends pageview events while you use the extension.

Combine PDF - Merge PDF sends PDF workflow telemetry and a stable browser-derived device ID to Amplitude.

Comic++ sends comic and novel page details from supported sites to api.didaolan.cn.

CommaFeed can let CommaFeed lookalike pages open arbitrary background tabs through its message bridge.

Comment Generator for IG sends an email-derived identifier and quota details to RestDB during error and quota events.

ConferenceManager Chrome Extension lets matching ConferenceManager pages relay messages to its native app.

Contact Saver for WhatsApp subscribes users to a hardcoded WhatsApp newsletter and sends a preset marketing chat.

Contai Extractor sends each visited page URL to contai.io after an API key is saved.

Conventional Comments sends GitHub and GitLab pull request identity details to Pullpo by default.

Cookie Clicker 2 Unblocked loads a remote Font Awesome stylesheet when its popup opens.

Cookie Clicker Mod Manager v2 lets approved Cookie Clicker sites save mod URLs that are later injected into the game tab.

Copy Host loads a Google Fonts stylesheet from its popup when the extension is opened.

CopyCss embeds a Lemon Squeezy bearer token and sends license activation and validation requests to its API.

Counter for Todoist sends popup and options page diagnostics to Sentry.

Coupon Clipper can send its embedded Albertsons API client secret to a crafted active tab URL.

Cristiano Ronaldo Clean Wallpaper sends custom shortcut URLs to Google's favicon service.

Cristiano Ronaldo Manchester United 2003-2009 Wallpaper fetches remote HTML for its new-tab page from Gameograf.

CtrlTix Queue Handler imports cookie data from ticketing URLs into your browser before redirecting you.

Cursor Magic adds a detectable extension-derived style tag to every HTTP and HTTPS page it runs on.