Low risk browser extensions

DevTools Suite exposes its extension ID to pages when Tailwind mode injects a page-visible script URL.

Dictation App sends a persistent user ID and dictation-use analytics to Amplitude.

Direct File Link Downloader lets any webpage prompt downloads for selected file-like URLs through its all-sites content script.

Discord Login with Token puts the entered Discord token in a discord.com URL and stores it in page localStorage.

Dlicom - Crypto Wallet contains a hardcoded wallet unlock password and submits it automatically after onboarding.

Dodge Challenger SRT Hellcat Live Wallpaper sends new-tab shortcut URLs to Google's favicon service.

DogeUni exposes wallet public key, balance, and inscriptions to websites through its injected provider without approval.

Dolphin Browser for PC version - New Tab BG loads a stylesheet from unpkg.com whenever its new-tab page opens.

Doodle Jump Original silently allows browser notifications from playdoodleoriginal.digital.

Doodle Jump Popup loads popup font and image assets over plaintext HTTP from Google Fonts and Imgur.

Dork It loads its popup styling from jsDelivr and Google Fonts when the toolbar popup opens.

Double Click to Save Image lets any page trigger extension-privileged downloads from page-chosen image URLs.

Downloader for Loom exposes active download queue details to any web page through its content-script event bridge.

DragImages lets page scripts trigger downloads of image URLs through its all-pages drag handler.

Dragon Ball Gohan's Power Live Wallpaper sends shortcut URLs to Google's favicon service on the new-tab page.

Dragon Samurai Anime Boy Live Wallpaper sends saved shortcut URLs to Google's favicon service on each new tab page.

Dreamdata sends the active tab URL to Dreamdata when tabs change or finish loading.

DropMail.me injects a Google Fonts stylesheet into every HTTP and HTTPS page when its autofill menu is enabled.

Dubai Wallpaper sends Chrome topSites URLs to Google's favicon service when opening a new tab.

EASY AGENTS rewrites Kakobuy and CNFans product-page URLs to add affiliate/referral identifiers.

ESPRIT Portal sends stored academic profile data and a persistent viewer key to remote ad endpoints.

ETH Ticker sends watched cryptocurrency market symbols to allcrypto.info over a cleartext price-feed connection.

EXPERIO lets any website write values that it later autofills into Moroccan tax portal login forms.

Easy Custom Autofill stores custom entries locally and loads Google Fonts and jsDelivr styles when its UI pages open.

Easy Share sends active-tab and top-site URLs to Google's favicon service on its new-tab page.

EbayGPT injects extension resource URLs into supported pages, making its installed extension ID visible there.

Edit anything - Boost any page sends page-provided email values to myexthub.com.

Eevee Pokemon Live Wallpaper fetches remote Gameograf popup HTML and renders it inside its new-tab page.

Elden Ring Wallpaper sends user-added shortcut URLs to Google's favicon service.

EloWard sends Twitch League of Legends viewing qualification tied to the stored Riot PUUID after a 5-minute watch threshold.

Email Tracking for Gmail by MailVibes sends Gmail feature requests to the MailVibes API with a bundled API key.

Enable Copy can send selected page text to Facebook GraphQL using the user's logged-in Facebook session.

Enhanced File Explorer for Chrome loads Google Fonts when it displays local file directory pages.

Enhancer for TextNow Web embeds a remote install page with clipboard read and write access.

Eren Yeager Live Wallpaper sends shortcut URLs to Google's favicon service when its new tab page renders.

Etsy Image Search sends selected image URLs to Yandex over a cleartext HTTP reverse-image-search URL.

Extenship Application Launcher sends Amazon product dimensions and prices to a raw IP address over HTTP.

F.B Data Scraper - Posts, Comments copies full page HTML from every HTTP and HTTPS site into the extension.

FACE-X sends Steam profile IDs from Steam Community pages to Faceit and CSStats to display Counter-Strike stats.

FC 26 Sniping Bot & Autobuyer lets listed football sites call background actions that read settings and use its backend API.

FLIKOVER loads remote stylesheets and images from Flikover and public CDN hosts when its popup opens.

FLYFF_Helper lets any site send commands to its local FlyFF WebSocket bridge.

FNAF Live Wallpaper loads Google-hosted font resources each time its custom new tab page opens.

FNaF Cursor - Custom Horror Cursor for Chrome adds a page-readable extension ID prefix to every website it runs on.

FOLDING AT HOME IN THE DARK lets any site load its control page, poll the local Folding@Home client, and send slot samples.

Gaugr for Claude.ai uploads Claude account metadata and usage history to gaugr.app for cloud sync.

Facebook Comments Exporter removes Content-Security-Policy headers on Facebook pages before injecting its scripts.

FelarisVPN sends signed proxy-list requests using API and cache keys embedded in the extension.

Fenerbahce SK Anasayfa - FB NewTab checks chrome-extesions.com at install time and can open a tab to a URL it returns.

FigShot lets an enabled page ask its background worker to fetch arbitrary URLs and return the response data.

Fillify lets webpages trigger AI field-filter requests that send form context and page details to the user's AI provider.

Finder Shopping sends a bundled API authorization token to Grow My Money endpoints.

Five Nights at Freddy Wallpaper sends Chrome top-site URLs to Google's favicon service on the new-tab page.

Five Nights at Freddy's Live Wallpaper sends new-tab shortcut URLs to Google's favicon service.

Five Nights at Freddy's Live Wallpaper sends user-added shortcut URLs to Google's favicon service.

Fiverr Quick View loads an ImageKit GIF on Fiverr pages, sending the page referrer and IP address with the request.

Flash Player can let sandboxed Flash content ask the extension to fetch arbitrary URLs.

Flash Player Emulator writes its extension runtime ID into page DOM classes during Flash emulation.

FlightSeats.io Reward Seat Finder sends flight and hotel search details from airline booking pages to FlightSeats cloud endpoints.

FlowX sends X/Twitter account lookups and login actions to api.rootdata.com.