Low risk browser extensions

Lamborghini Aventador Live Wallpaper New Tab loads remote popup HTML into its new-tab page.

Lamborghini Live Wallpaper inserts remote HTML from Gameograf into its new tab popup.

Lamborghini Revuelto Live Wallpaper loads remote popup HTML from api.gameograf.com into its new-tab page.

Laya Tree lets page scripts send inspector commands that read and modify Laya game objects.

Lazuli inserts remote teacher-score feed values into ZJU course-selection pages as HTML without escaping.

Legal Forms and Agreements opens selected legal-document links on LawDepot over cleartext HTTP.

Leganto Cite it! Bookmarking Tool lets any website ask the extension to reload an open tab.

Lets Kick It! loads a BetterTTV sound asset when matching Kick chat keywords appear.

Letterboxd Streaming Providers bundles a decodable TMDB API bearer token and sends it to api.themoviedb.org.

Librezam can send recorded audio samples to ACRCloud when its default recognition credentials are enabled.

LightningProxies Extension supplies stored proxy credentials to every HTTP authentication challenge.

Limbic for Therapists can send delimited page text from later sites to Limbic Atlas after retaining stale EHR context.

Lingo Champion sends selected words and matching visible page sentences to lingochampion.com for translation.

Lionel Messi Live Wallpaper sends saved new-tab shortcut URLs to Google's favicon service.

Lionel Messi Live Wallpaper sends each saved new-tab shortcut URL to Google's favicon service when rendering shortcuts.

ListenOnRepeat: Youtube to LOR ships a Google YouTube Data API key in its popup playlist request.

Live NBA Scores & Stats - GameDash sends page-view details from every website to Mixpanel.

Liver sends popup requests to Holodex with a bundled API key.

LlamaSearch sends displayed bookmark hostnames and top-site URLs to Google's favicon service.

LockPage installs a default page-lock password of 123 and uses it to unlock overlays on HTTPS pages.

Locker - Password Manager accepts sign-in tokens posted from pages and sends them to Locker's SSO endpoint.

LodestarALM Extension sends every HTTP and HTTPS page URL to its native messaging host.

Lofi Girl fetches remote audio ad feeds and simulates ad playback events from its background service worker.

Lucid loads Google Fonts from Google each time it replaces the new tab page.

LuckyCoin Wallet exposes the unlocked account address to every website through its injected provider.

Luffy Gear 5 Live Wallpaper sends saved new-tab shortcut URLs to Google's favicon service.

Luxxle sends hostnames from your browser's top-sites list to DuckDuckGo for favicon images.

MANISH loads Google Material Icons over plaintext HTTP when its extension UI pages open.

METAWALLET ships a hardcoded HMAC secret that signs requests to the Metacoin backend.

MONI exposes its extension ID, version, and URL inside Monday.com pages.

MPCVault lets any webpage set the extension's stored login token through its injected login bridge.

Mafuyu PJSK Live Wallpaper sends user-added shortcut URLs to Google's favicon service when rendering its new tab page.

Magnetar sends detected torrent hashes to the configured debrid provider for cache checks.

Making Today loads Google Fonts from its new-tab page, sending each new-tab request to fonts.googleapis.com.

Manchester City Wallpapers fetches remote popup HTML and displays it on the extension's new tab page.

MangaToon For PC Windows 10 sends top-site URLs to Google when showing favicons on its new-tab page.

Map Route Pro embeds an Azure Maps key and sends map search requests to atlas.microsoft.com.

MarketDB - Аналитика Магнит Маркета stores report UUIDs in mm.ru localStorage and sends them to MarketDB report APIs.

Marketplace Listings Reposter can send masked Facebook page activity recordings to Sentry.

Marvel Rivals Live Wallpaper sends user-added shortcut URLs to Google's favicon service.

Matrix Start Tabs sends failed navigation hostnames to matrixstarttabs.com.

Max Verstappen Red Bull F1 Champion Maserati Live Wallpaper inserts Gameograf popup HTML into its new-tab page.

MayiFree-開水小助手 redirects a game script to remote code hosted on fish.mayifree.com.

Medium for All deletes cookies for Medium requests, including cookies from the page that initiated the request.

MemoTab sends daily counts of notes, boards, shortcuts, iframes, checklists, and focus sessions to api.memotab.space.

Mesh lets any site trigger its web-accessible iframe to identify the signed-in account to Segment.

Messi Live Wallpaper sends new-tab shortcut domains to Google to load favicon images.

Messi Wallpapers sends custom new-tab shortcut URLs to Google's favicon service.

MetaPush sends session and error telemetry from scoped NFT site pages to sentry.fuxi.netease.com.

MiFone MITEK sends call metadata and local WebRTC IP details to a hardcoded n8n-dev.mitek.vn webhook during poor call quality.

Michael Jordan MeaVana removes Content-Security-Policy and frame-protection headers through dynamic network rules.

Microsoft Audio-Content-Creation TTS Exporter enables Amplitude tracking on Microsoft audio content creation pages.

Milleis Digital - Custom CSS injects remote background images into Milleis and BQE banking pages.

MindTree exposes its extension ID in page-visible resource URLs on ChatGPT.

Mine Finder sends popup usage events to Google Analytics with a persistent extension client ID.

Minecraft Live Wallpapers New Tab loads Gameograf-controlled shortcuts and popup HTML on its new tab page.

Minecraft Sakura Pond Live Wallpaper sends shortcut URLs to Google when it loads favicons on the new-tab page.

Minelead reads active-tab page text to find email addresses and sends them to api.minelead.io for validation.

Mobicip adds its filter token and version headers to every HTTP and HTTPS request it matches.

MoneyNex exposes the current wallet address to any website through its injected page API.