Low risk browser extensions

Yeastar Linkus for Google connects to a user-configured PBX and transmits diagnostic logs containing usernames and extension numbers to it.

Ziplyne JH Production Player sends guide interaction data, page URLs, and user identifiers to a Johns Hopkins Ziplyne API server.

draw.io for Notion sends a 1x1 tracking-pixel request to log.draw.io each time you create or edit a diagram on a Notion page.

pp calculator computes osu! pp scores on beatmap pages and sends Mixpanel usage analytics from its popup and options pages.

Turbo Download Manager accepts download commands from any other installed Firefox extension without validating the sender's identity.

Teleparty sends page URLs, tab titles, and user identity to its analytics servers on every watch-session event.

Dark Mode (WebExtension) applies dark styling across all websites by injecting CSS and JavaScript into every page.

Alby connects to Bitcoin Lightning nodes and sends page metadata, selected text, and account details to its own servers during normal wallet operations.

Allkeyshop writes an affiliate-attribution cookie on eneba.com's checkout page to claim referral commission on the sale.

BookWidgets reads the user's Google account email from classroom.google.com and sends it to bookwidgets.com on panel open.

CFCA CryptoKit accepts a caller-supplied native host name from bank-domain pages and connects to it without validating it against an allowlist.

CXone Agent Noise Cancellation provides audio noise cancellation for NICE CXone contact-center agents and exposes no external data collection.

Caoliao QR Code sends a persistent UUID and userAgent to its vendor analytics endpoint on each user action.

ChinaHelper silently redirects ordinary AliExpress product page visits through an affiliate link carrying the developer's own tracking IDs.

Flash AI sends the full URL of nearly every page you visit to its servers to detect product pages.

Gather 1.0 Meetings (Classic) sends the signed-in Gather user ID and email-derived profile details to its telemetry endpoint.

Google Analytics UTM Builder ships its developer's confidential Bitly OAuth client secret hardcoded in the extension bundle.

The extension accepts unauthenticated postMessage image data and its popup fetches attacker-supplied URLs with the user's cookies attached.

Insert and Send HTML with Gmail transmits a hashed version of the signed-in Gmail address and compose-action events to Google Cloud Pub/Sub.

Lingopie intercepts Netflix and Disney+ subtitle tracks and sends the caption text to its own servers for translation.

Lolli sends the hostname of every site you visit to its own servers to check for a cashback match.

Lucky PDF Converter's new tab page routes its 'coupons' and 'recommended' shortcuts to BeFrugal through a hardcoded affiliate link.

MathWallet exposes the unlocked selected wallet account to HTTP and HTTPS pages where its provider is injected.

Mo'Kick fetches unversioned CSS from a GitHub Gist on every kick.com page load without integrity verification.

New Tab Studio fetches favicons for your saved shortcuts over plain HTTP, sending each shortcut's hostname in the clear.

Omnimed-QHR authenticator forwards messages from Omnimed web pages to a local smartcard signing app without validating the request.

PixelBlock blocks email tracking pixels in Gmail and registers a permissive Trusted Types 'default' policy that relaxes Gmail's DOM-XSS protections.

Radioplayer UK opens the radioplayer.co.uk listen page in a popup window when you click its toolbar button.

Reading List fetches a favicon from DuckDuckGo for each saved page, disclosing the hostnames of your reading list to a third party.

Reel Downloader for Instagram sends a persistent user ID to a third-party server on startup and captures Instagram session headers.

Savvy by Wethrift sends page URLs and titles from visited sites to Google Analytics.

Search Engine by SoSearcher sets itself as the default search provider and routes every address-bar query through sosearcher.com with a fixed partner tag.

The extension bridges Serasa Experian web pages to a local native host (br.experian.com.serasa) for PKI operations including certificate signing and management.

Speed Booster for ChatGPT modifies the ChatGPT page to reduce lag and transmits license keys to Freemius in URL query parameters.

Translate and Speak Subtitles for YouTube sends device and usage telemetry to a third-party Aliyun log endpoint on install and on UI clicks.

Treatstream reads your delivery address from food-ordering sites like GrubHub and sends it with a session token to treatstream.com.

YourTV Chrome extension bridges web pages to a native host using eval() on both incoming and outgoing messages, creating code-execution exposure.

mail.com MailCheck scans open tab URLs at install to capture affiliate codes and sends account and install data to go.mail.com on uninstall.

n8n Chat reads your full n8n workflow JSON and sends it to the AI provider you choose (OpenAI, Anthropic, or Google Gemini).

Шоппер sends product URL, title, price, and brand to shopper.bonbot.ru on every marketplace visit, linked to a per-install UUID.

TinEye loads a Google Fonts stylesheet into the active tab when displaying its notification UI, sending the tab URL to Google as a Referer.

uBlacklist filters search results on Google and other engines using user-maintained or subscription blocklists.

IBM Aspera Connect relays unvalidated messages from any web page to the locally-installed Aspera native host.

YouTube Downloader adds download buttons to YouTube watch pages and fetches YouTube's player JS at runtime to decode video URLs.

Shipping Details & Search installs an affiliate-tagged Yahoo search provider and forwards saved tracking numbers to shippingdetails.com.

Map Route Pro and Search relays search queries and inferred location to its servers and replaces your default search engine with Yahoo.

Manuals Hunt and Search overrides the default search engine to Yahoo with undisclosed affiliate tracking parameters on every search.

CyberGhost VPN Free Proxy bundles a hardcoded shared API key that is sent to its backend on every request.

Buster bundles Wit.ai API credentials encrypted with a key derived entirely from its own publicly distributed source files.

Easy Games Tab routes all user searches through Yahoo affiliate URLs with hardcoded monetization parameters.

LetyShops sends account tokens and browsing events to Google Analytics and a GCP endpoint; opt-in on Firefox, opt-out on Chrome.

Flash Player Plus sends a persistent unique user ID and session timing data to flplayer.net on a recurring schedule.

BlockSite sends per-navigation browsing history and a persistent device identifier to its servers when the user enables analytics.

Repeek sends FACEIT user IDs and Steam IDs to its own servers when viewing match pages on faceit.com.

Ezy Speed Test & Custom Web Search replaces the browser's default search engine with Yahoo search using embedded affiliate codes.

2048 Classic Game sends a persistent UUID to Google Analytics every 60 minutes and writes the extension's runtime ID into visited page DOM.

AI Detector - BitMind sends captured image data and page URLs to api.bitmind.ai for AI-generated content detection on every website.

AZInsight sends Amazon visit counts and domain names to api.loopedin.io on every Amazon page load.

Amazon Prime Freevee Skipper sends Amazon account details, watch history, and email address to me3x.online and metricsmint.quest.

Belfius Smart Card Reader relays commands from permitted web pages to a native card reader host via native messaging.