Low risk browser extensions

CFCA CertEnrollment bridges ADBC bank pages to a local native application for certificate-based authentication.

CFCA CryptoKit.ADBC bridges pages on adbc.com.cn and hellotech.top to a locally installed bank PKI/certificate app via native messaging.

Capturables exposes a persistent install identifier to every visited page.

Capture to a Gif sends the hostname of the page you record to Google Analytics on each GIF or PNG capture, tied to a persistent install ID.

CoffeTab replaces your new-tab page with a meta-refresh that immediately redirects every new tab to coffetab.com.

Convert Picture to Text runs Tesseract OCR locally in the browser, fetching language model files from an external CDN when processing images.

CyberGhost Cookie Cleaner sends domains shown in its exceptions UI to Google's favicon service.

GA4 Debugger reads GTM dataLayer events on every visited page and displays them in a DevTools panel.

Dolby Voice 1.3 exposes a postMessage bridge on all pages that allows any web page to relay messages to the native Dolby Voice application.

I'm a Gentleman lets any visited page trigger downloads of image URLs through synthetic click or drag events.

I'm not robot captcha clicker auto-clicks the Google reCAPTCHA "I'm not a robot" checkbox for you whenever one appears.

MP3 Converter & Downloader sends an extension-generated UUID to Google Analytics over HTTP.

Minesweeper Original sends a UUID-based identifier to Google Analytics every 60 minutes while the browser is running.

Minimal Theme for Twitter / X sends user-clicked Twitter/X draft text to Typefully in a new URL.

Mo'Kick fetches unversioned CSS from a GitHub Gist on every kick.com page load without integrity verification.

MyIPCam sends activation codes to myipcamapp.net over unencrypted HTTP and contains a hardcoded offline bypass key.

Netwrix Password Secure captures form fields including passwords on every page and fetches autofill configuration from netwrix.com on startup.

Outsurf downloads shortcut rules from outsurf.net and redirects matching Google searches to configured destinations.

Quidco Cashback Reminder tracks every URL visited against 4,847 merchant domains and sends interaction events with a persistent UUID to Google Analytics.

SEO Extension by Mangools sends the current tab URL to Google PageSpeed and Rollbar using hardcoded API keys embedded in the extension.

Salesforce DevTools embeds a hardcoded OAuth client secret in its source that any user can extract from the CRX file.

Skins for YouTube receives CSS and image URLs from youtube-skins.com and injects them into YouTube pages, with the operator able to open new tabs remotely.

Skribbl.io Cheats fetches a word list from a third-party npoint.io bucket on every skribbl.io page load and displays clickable word hints based on the current round's letter pattern.

Speed Auto Clicker accepts parent-frame selection commands in iframes and sends clicked coordinates back.

Steamlvlup Card Factory writes server-returned bytes onto the user's authenticated Steam WebSocket to auto-play games and farm cards.

Synapse Pathology Workflow Extension lets matching HTTPS pages control its dual-screen workflow windows.

Text to Speech TTS AI | Readvox sends TTS failure telemetry with page text and URL details to Google Analytics.

UI5 Inspector lets page scripts trigger injection of extension-packaged scripts into the active tab.

Ziplyne JH Production Player sends guide interaction data, page URLs, and user identifiers to a Johns Hopkins Ziplyne API server.

draw.io for Notion sends a 1x1 tracking-pixel request to log.draw.io each time you create or edit a diagram on a Notion page.

pp calculator computes osu! pp scores on beatmap pages and sends Mixpanel usage analytics from its popup and options pages.

Teleparty sends page URLs, tab titles, and user identity to its analytics servers on every watch-session event.

Dark Mode (WebExtension) applies dark styling across all websites by injecting CSS and JavaScript into every page.

TinEye loads a Google Fonts stylesheet into the active tab when displaying its notification UI, sending the tab URL to Google as a Referer.

AliPrice runs on every website and sends the URL, title and referrer of each page you visit to Google Analytics and its own servers.

Alby connects to Bitcoin Lightning nodes and sends page metadata, selected text, and account details to its own servers during normal wallet operations.

Allkeyshop writes an affiliate-attribution cookie on eneba.com's checkout page to claim referral commission on the sale.

BookWidgets reads the user's Google account email from classroom.google.com and sends it to bookwidgets.com on panel open.

CFCA CryptoKit accepts a caller-supplied native host name from bank-domain pages and connects to it without validating it against an allowlist.

CXone Agent Noise Cancellation provides audio noise cancellation for NICE CXone contact-center agents and exposes no external data collection.

Caoliao QR Code sends a persistent UUID and userAgent to its vendor analytics endpoint on each user action.

ChinaHelper silently redirects ordinary AliExpress product page visits through an affiliate link carrying the developer's own tracking IDs.

Elfster's Wish It! prefills its wishlist form from a browser message sent by any web page, with no check on who sent it.

Flash AI sends the full URL of nearly every page you visit to its servers to detect product pages.

Gather 1.0 Meetings (Classic) sends the signed-in Gather user ID and email-derived profile details to its telemetry endpoint.

Google Analytics UTM Builder ships its developer's confidential Bitly OAuth client secret hardcoded in the extension bundle.

The extension accepts unauthenticated postMessage image data and its popup fetches attacker-supplied URLs with the user's cookies attached.

Insert and Send HTML with Gmail transmits a hashed version of the signed-in Gmail address and compose-action events to Google Cloud Pub/Sub.

Lingopie intercepts Netflix and Disney+ subtitle tracks and sends the caption text to its own servers for translation.

Lolli sends the hostname of every site you visit to its own servers to check for a cashback match.

LoveDeals reports the host of nearly every site you visit to lovedeals.ai and scrapes your Google search result URLs.

Lucky PDF Converter's new tab page routes its 'coupons' and 'recommended' shortcuts to BeFrugal through a hardcoded affiliate link.

MathWallet exposes the unlocked selected wallet account to HTTP and HTTPS pages where its provider is injected.

New Tab Studio fetches favicons for your saved shortcuts over plain HTTP, sending each shortcut's hostname in the clear.

Omnimed-QHR authenticator forwards messages from Omnimed web pages to a local smartcard signing app without validating the request.

PixelBlock blocks email tracking pixels in Gmail and registers a permissive Trusted Types 'default' policy that relaxes Gmail's DOM-XSS protections.

PubPeer queries its API on each page load and injects comment-link banners into matching academic publication pages.

Radioplayer UK opens the radioplayer.co.uk listen page in a popup window when you click its toolbar button.

Reading List fetches a favicon from DuckDuckGo for each saved page, disclosing the hostnames of your reading list to a third party.

Reel Downloader for Instagram sends a persistent user ID to a third-party server on startup and captures Instagram session headers.