Low risk browser extensions

Gmail Inbox Zero by cloudHQ collects Gmail account-switcher email addresses and sends them to www.cloudhq.net.

GoEmailTracker sends your Gmail address to its tracking domains when tracked pixels load or tracked links are clicked.

GoingMed sends journal names, PubMed IDs, and DOIs from academic pages to publication lookup services.

Goku Black Rose Transformation Live Wallpaper sends shortcut URLs to Google's favicon service on each new-tab render.

Goku Destined Live Wallpaper New Tab fetches remote popup HTML from Gameograf and inserts it into the new-tab page.

Goku Falling Stars fetches remote message HTML and inserts it into its new tab page.

Google Drive Dark Mode lets any page ask its background worker to fetch cross-origin stylesheets and insert the response.

Google Meet Meat injects a meetmeat.gmeetmeat.xyz iframe into Google Meet pages.

Google Search Suggestion Extractor loads its popup stylesheet from stackpath.bootstrapcdn.com when opened.

Google Trends Everywhere sends Google search result domains and SimilarWeb traffic data to a Cloudflare Worker.

Google SERP Simulator by Semalt can disable installed SEO extensions from a Semalt-controlled ID list.

GotDibbs Toolbox for Dynamics 365/Power Apps reports the loading page hostname to Sumo Logic.

Graderoom lets allowed external pages request authenticated PowerSchool grade data through the extension.

Green Tree Search sends your frequently visited site URLs and titles to greentreesearch.com.

Grok to PDF embeds OAuth client secrets used when connecting Yandex Disk and Notion accounts.

Groups Watcher sends Facebook GraphQL requests with a spoofed Origin header and posts support/error details to Discord webhooks.

GuinRank-Write stores its extension URL in each site's localStorage when its content script runs.

Guinea Pig Wallpaper sends top-site and saved shortcut URLs to Google's favicon service on its new-tab page.

Gõ công thức toán LaTeX trong comment Facebook opens a CodeCogs LaTeX editor over unencrypted HTTP.

HG Insights Sales Copilot sends your Chrome profile email to MadKudu tracking endpoints on install and updates.

HKU Moodle Helper loads a third-party icon stylesheet on Moodle pages and sends submitted feedback to richku.com.

HTLiveSight reconstructs a Hattrick CHPP OAuth consumer secret from its shipped source.

Habit Tracker loads a Google Fonts stylesheet each time its new-tab page opens.

Haiku lets web pages ask its extension recorder to start microphone or camera capture.

Halloween Black Cat Live Wallpaper inserts popup HTML from api.gameograf.com into its new-tab page.

Halloween Cinnamoroll Pumpkins Spooky Cute Live Wallpaper sends shortcut URLs to Google's favicon service.

Halloween Cute Anime Girl Live Wallpaper fetches popup HTML from api.gameograf.com for its new-tab page.

Halo Infinite Wallpaper sends URLs from your most-visited sites to Google's favicon service.

Hanako Kun Wallpaper sends up to 10 top-site URLs to Google when rendering its new-tab Most Visited menu.

HealthGuard embeds NewsGuard API credentials and uses them to request anonymous tokens and content-label services.

Helcim Payment Extension sends page URLs and Helcim account settings from supported billing sites to Datadog.

Hello Kitty Friends Live Wallpaper sends saved shortcut URLs to Google's favicon service when it renders the new-tab page.

Hi Translate extension sends selected text, page text, WhatsApp messages, and YouTube captions to api.translasion.com.

HiddenBatVPN stores its proxy authentication password in persistent local extension logs.

Hide Mouse for Hulu loads a remote c.stoopid.fun image when its popup is opened.

Highlight IP Lookup sends selected text from the active page to ip-api.com for IP location lookup.

Hilltoppers sends extension analytics events and an embedded API secret to Google Analytics.

Hinkal Wallet lets any website switch the wallet's active blockchain network without a session check.

Hirecarta sends autofill field values, selectors, page URLs, and local storage identifiers to hirecarta.com analytics.

Hirecentive Coach reads job postings and displays skill-match results on supported job-board pages.

Holiday Calendar fetches regional calendar data over plaintext HTTP from calendar-crx.diary8.com.

Hologram runs on video meeting sites to provide virtual avatar and video features.

Homer Simpson Live Wallpaper sends new-tab shortcut URLs to Google's favicon service.

Homie VPN routes user-enabled browser traffic through remote proxy nodes from api.freeproxy.online.

Honda Civic Type R Live Wallpaper sends user-added shortcut URLs to Google's favicon service.

Hotel Ninja sends booking and confirmation page details from travel sites to reports.hotel-ninja.com.

Howdy - AI Messages Assistant lets matched external pages query your Instagram account through extension cookies.

Howl.Link captures the current page URL, OpenGraph image, and OpenGraph title on every matched site.

Hudu Password Manager's passkey origin check lacks public-suffix logic, letting a shared subdomain spoof its parent as the passkey rp.id.

Hulu Extended injects Google Fonts on Hulu pages, causing those page visits to request Google-hosted font resources.

Huru sends the current page's full HTML to its Supabase function when you create an interview.

HybridTV Dev Environment lets HbbTV pages navigate the tab and rewrite User-Agent headers.

Hyros Talk has no confirmed data-recipient behavior recorded in this scanner.

ICC Cricket Updates loads cricket scores and ranking HTML from an unauthenticated HTTP API into its popup.

The extension sends visited website hostnames to MiniITS for logged-in users when its content script loads.

IITG AutoLogin++ stores IITG login credentials locally with a hardcoded encryption key and submits them to the campus portal.

IRCTC Tatkal Autofill Assistant stores saved booking profiles in local extension storage as plaintext by default.

Importador de Notas Mineduc sends teacher identity details and a stable browser fingerprint to its license API.

Incognito Adblocker lets opener pages request the current URL and insert elements into pages where it runs.

Infera Lite sends its bundled backend API key to Infera endpoints during job-count and link-status checks.