Low risk browser extensions

Snek Tab sends new-tab search queries to ext.snektab.com and saved shortcut URLs to Google's favicon service.

Speed Auto Clicker accepts parent-frame selection commands in iframes and sends clicked coordinates back.

Text to Speech TTS AI | Readvox sends TTS failure telemetry with page text and URL details to Google Analytics.

Unblocked Games — New Tab sends top-site and bookmark URLs to gamestabs.com for favicon loading.

Unsplash Instant assigns each user a persistent UUID and transmits it to Google Analytics on every new tab open.

XB block all ads sends the current tab URL and browser details to AdGuard when users submit a website report.

Yeastar Linkus for Google connects to a user-configured PBX and transmits diagnostic logs containing usernames and extension numbers to it.

Ziplyne JH Production Player sends guide interaction data, page URLs, and user identifiers to a Johns Hopkins Ziplyne API server.

Livdub sends the domain of every page you dub, a persistent install ID, and session details to its own telemetry server.

VaSaham fetches Tehran Stock Exchange market data over plaintext HTTP from tsetmc.com and a set of hardcoded raw-IP mirror hosts.

Watch2Gether is a co-viewing extension that lets users share and watch videos together on w2g.tv.

Chrome Mask fetches a Chrome version number from a third-party server and injects it into request headers on user-whitelisted sites.

Metric Unit Converter & Search replaces the default search engine with a Bing affiliate URL on install.

Evernote Web Clipper embeds a hardcoded HMAC secret in its bundle and accepts UI-trigger messages from any web origin.

Vue.js devtools is a browser developer tool that inspects Vue.js applications running on the current page.

Download Manager (S3) modifies Content-Security-Policy headers on every page and can send downloaded file hashes to VirusTotal.

Turbo Download Manager accepts download commands from any other installed Firefox extension without validating the sender's identity.

Anywear reads your signed-in Chrome profile email on install and sends it to its servers with an install ID.

Bittorent For Chrome sends your saved uTorrent Web UI password as a Basic-Auth header over plain HTTP and to message-supplied URLs.

Block Websites Focus Timer sends usage metrics and a persistent device ID to Amplitude's EU analytics servers.

BookWidgets reads the user's Google account email from classroom.google.com and sends it to bookwidgets.com on panel open.

CFCA CertEnrollment bridges ADBC bank pages to a local native application for certificate-based authentication.

CFCA CryptoKit.ADBC bridges pages on adbc.com.cn and hellotech.top to a locally installed bank PKI/certificate app via native messaging.

Capturables exposes a persistent install identifier to every visited page.

Capture to a Gif sends the hostname of the page you record to Google Analytics on each GIF or PNG capture, tied to a persistent install ID.

CoffeTab replaces your new-tab page with a meta-refresh that immediately redirects every new tab to coffetab.com.

Convert Picture to Text runs Tesseract OCR locally in the browser, fetching language model files from an external CDN when processing images.

CyberGhost Cookie Cleaner sends domains shown in its exceptions UI to Google's favicon service.

GA4 Debugger reads GTM dataLayer events on every visited page and displays them in a DevTools panel.

Dolby Voice 1.3 exposes a postMessage bridge on all pages that allows any web page to relay messages to the native Dolby Voice application.

Google Analytics UTM Builder ships its developer's confidential Bitly OAuth client secret hardcoded in the extension bundle.

I'm a Gentleman lets any visited page trigger downloads of image URLs through synthetic click or drag events.

I'm not robot captcha clicker auto-clicks the Google reCAPTCHA "I'm not a robot" checkbox for you whenever one appears.

MP3 Converter & Downloader sends an extension-generated UUID to Google Analytics over HTTP.

MathWallet exposes the unlocked selected wallet account to HTTP and HTTPS pages where its provider is injected.

Minimal Theme for Twitter / X sends user-clicked Twitter/X draft text to Typefully in a new URL.

Mo'Kick fetches unversioned CSS from a GitHub Gist on every kick.com page load without integrity verification.

MyIPCam sends activation codes to myipcamapp.net over unencrypted HTTP and contains a hardcoded offline bypass key.

NetMirror Web fetches a remote profile every 3 hours that rewrites the Referer header on requests to chosen domains.

Netwrix Password Secure captures form fields including passwords on every page and fetches autofill configuration from netwrix.com on startup.

Outsurf downloads shortcut rules from outsurf.net and redirects matching Google searches to configured destinations.

Quidco Cashback Reminder tracks every URL visited against 4,847 merchant domains and sends interaction events with a persistent UUID to Google Analytics.

SEO Extension by Mangools sends the current tab URL to Google PageSpeed and Rollbar using hardcoded API keys embedded in the extension.

Salesforce DevTools embeds a hardcoded OAuth client secret in its source that any user can extract from the CRX file.

Skins for YouTube receives CSS and image URLs from youtube-skins.com and injects them into YouTube pages, with the operator able to open new tabs remotely.

Steamlvlup Card Factory writes server-returned bytes onto the user's authenticated Steam WebSocket to auto-play games and farm cards.

Synapse Pathology Workflow Extension lets matching HTTPS pages control its dual-screen workflow windows.

Translate and Speak Subtitles for YouTube sends device and usage telemetry to a third-party Aliyun log endpoint on install and on UI clicks.

UI5 Inspector lets page scripts trigger injection of extension-packaged scripts into the active tab.

draw.io for Notion sends a 1x1 tracking-pixel request to log.draw.io each time you create or edit a diagram on a Notion page.

pp calculator computes osu! pp scores on beatmap pages and sends Mixpanel usage analytics from its popup and options pages.

Ezy Speed Test & Custom Web Search replaces the browser's default search engine with Yahoo search using embedded affiliate codes.

Teleparty sends page URLs, tab titles, and user identity to its analytics servers on every watch-session event.

Dark Mode (WebExtension) applies dark styling across all websites by injecting CSS and JavaScript into every page.

TinEye loads a Google Fonts stylesheet into the active tab when displaying its notification UI, sending the tab URL to Google as a Referer.

AliPrice runs on every website and sends the URL, title and referrer of each page you visit to Google Analytics and its own servers.