Low risk browser extensions

ChartsTab checks visited sites with chat-secreto.es and can redirect tabs with the hostname and full URL in the redirect.

Chat GPT Diagram sends PlantUML code blocks from ChatGPT pages to plantuml.com for diagram rendering.

The extension reads unread-message counts from open chat and social tabs and shows them as a toolbar badge.

ChatGPT Speed Booster copies extension membership details into ChatGPT page localStorage.

ChatGPT for Google Calendar bundles recoverable shared OpenAI and Gemini API keys for fallback AI requests.

ChatGPT for StackOverflow sends StackOverflow question page visits and page metadata to Mixpanel.

ChatGPT for Web Search loads remote jQuery on its sandboxed new-tab search page.

ChatGpt Россия fetches remote proxy rules that can route selected browsing destinations through its configured proxy.

Chibi Nezuko Kamado Pink Heart Anime Live Wallpaper sends saved shortcut URLs to Google's favicon service.

Chick Movie Ratings and Suggestions sends Google search movie titles, URLs, and locale metadata to Google Analytics.

Christmas Tree Wallpaper New Tab sends top-site URLs to Google's favicon service on each new-tab load.

ChromaTube posts its extension runtime ID into YouTube pages when its content script starts.

Chrome Cloudflare Helper inserts a GitHub-hosted badge image on Cloudflare pages, sending image-request metadata to GitHub.

Cinnamoroll Aesthetic Live Wallpaper loads Google Fonts resources whenever its new-tab page opens.

Clarity notes V2 returns stored access and refresh tokens to its approved web and localhost origins.

ClassInTheBox has no confirmed reviewed data-sharing behavior recorded in this scanner.

Claude Helper loads Google Fonts on claude.ai pages, sending page request context to Google font endpoints.

Clear all tabs lets any webpage trigger its injected widget to ask the extension to close other open tabs.

Click switch socks5 records page resource hostnames and saves proxy-routing domain relationships locally.

Click to Copy injects a copy toolbar into every website and places extension asset URLs in the page DOM.

ClipHutch monitors media requests and stores request headers used to fetch detected videos and images.

CloudDrive助手 disables page interaction and plays remote audio for Russian-language users on RU/SU/BY domains.

CoTik captures Shopee and Rebuy request headers and writes them into page localStorage.

Codeforces Custom Contests accepts cross-origin messages that create Codeforces gym contests from supplied problem and invite data.

Color Picker Dropper loads a remote placeholder image when its popup opens.

Color Pocket loads Google Tag Manager in its popup and sends pageview events while you use the extension.

Comic++ sends comic and novel page details from supported sites to api.didaolan.cn.

CommaFeed can let CommaFeed lookalike pages open arbitrary background tabs through its message bridge.

Comment Generator for IG sends an email-derived identifier and quota details to RestDB during error and quota events.

ConferenceManager Chrome Extension lets matching ConferenceManager pages relay messages to its native app.

Contact Saver for WhatsApp subscribes users to a hardcoded WhatsApp newsletter and sends a preset marketing chat.

Contai Extractor sends each visited page URL to contai.io after an API key is saved.

Conventional Comments sends GitHub and GitLab pull request identity details to Pullpo by default.

Cookie Clicker 2 Unblocked loads a remote Font Awesome stylesheet when its popup opens.

Cookie Clicker Mod Manager v2 lets approved Cookie Clicker sites save mod URLs that are later injected into the game tab.

Copy Host loads a Google Fonts stylesheet from its popup when the extension is opened.

CopyCss embeds a Lemon Squeezy bearer token and sends license activation and validation requests to its API.

Counter for Todoist sends popup and options page diagnostics to Sentry.

Coupon Clipper can send its embedded Albertsons API client secret to a crafted active tab URL.

Cristiano Ronaldo Clean Wallpaper sends custom shortcut URLs to Google's favicon service.

Cristiano Ronaldo Manchester United 2003-2009 Wallpaper fetches remote HTML for its new-tab page from Gameograf.

CtrlTix Queue Handler imports cookie data from ticketing URLs into your browser before redirecting you.

Cursor Magic adds a detectable extension-derived style tag to every HTTP and HTTPS page it runs on.

Custom Cursor for Chrome changes the cursor on every site and broadcasts its extension ID to pages.

Custom Cursors injects saved cursor styles into web pages using settings stored in the browser.

Cyborg Tiger Live Wallpaper New Tab fetches remote popup HTML from api.gameograf.com and inserts it into its new-tab page.

D365 Finance & Operations Dev Tools reads the system clipboard into its popup fields when opened.

DHGate Real Photos loads a hidden sale.dhgate.com iframe on DHGate product pages every 30 minutes.

DL Boost sends cached Downloads-folder filenames and SHA-256 file hashes to dlboost.com.

DOMLogger++ lets any web page use its message bridge to open tabs, update tabs, show notifications, and queue log data.

DXF Viewer lets webpage scripts trigger extension-privileged fetches of page-chosen DXF links for dxfviewer.app.

DarkPDF sends visited page URLs to trhonx.com and can load URLs returned by its remote configuration.

Darkmode for Classroom injects CSS that loads replacement Google Classroom icons from svgshare.com.

Data Scraper disables page interaction and plays looping audio for Russian-language users on .ru, .su, and .xn--p1ai sites.

DataGrab runs Mixpanel tracking code on every HTTP and HTTPS page it can access.

Death Note Wallpaper sends custom shortcut URLs to Google's favicon service when rendering the new-tab page.

Delete Instagram Messages removes Instagram's Content Security Policy headers so its scripts can modify Instagram pages.

Demodesk: AI Meeting Analyst sends logged-in Demodesk profile details to Segment analytics.

Demon Slayer Characters HD Wallpaper New Tab sends saved speed-dial hostnames to Google's favicon service.

Detectify Recorder sends recording auth tokens through page-visible frame messages that can write stored commands.