Low risk browser extensions

Sticky Notes stores editable note HTML from pages and can replay a global note across every site.

Stocksi Ultimate sends scoped error telemetry with page URLs and device/network details to websocket.priority.news.

Strava Heatmap attaches your Strava cookies to global heatmap tile requests and makes the responses readable by other sites.

Straw Hat Live Wallpaper sends each saved shortcut URL to Google's favicon service when opening a new tab.

StreamPod exposes Twitter OAuth callback pages that exchange supplied codes and send Twitter tokens to StreamHQ services.

StudyPal AI sends submitted questions to OpenAI using a bearer API key bundled in the popup.

Subtitle Masker injects an on-page overlay whose element IDs include the extension runtime ID.

SuitePrint sends SuiteFiles usernames and passwords in the login request URL.

Suno Explorer submits aggregate Suno library metrics to a Supabase endpoint after indexing and on a daily alarm.

Super Cloner can replay source funnel metadata from any HTTP(S) page into GoHighLevel clone APIs.

Super Focus Tabs captures active-tab screenshots on all URLs and stores them locally for tab previews.

Super GSC sends signed-in email addresses and Search Console keyword queries to api.supergsc.com.

Super Kulasis sends Kyoto University course and professor names from KULASIS pages to tatekan.copynight.net.

Super Megavendas sends user-selected WhatsApp chat transcripts to Google Gemini for AI conversation analysis.

Super PDF Split Merge lets any embedding website trigger downloads through its web-accessible option page.

SuperDrag turns page drag gestures into browser tab opens for links, images, and selected text.

Swipe Offers Spy exposes stored account details and authenticated transcription requests to Facebook Ads Library page scripts.

System Info opens a Chrome Web Store promotion tab for another extension after updates.

TTok Automation sends your TikTok uniqueId and auto-comment settings to Alibaba Cloud SLS telemetry.

TUAT Autofill Extension adds a Buy Me a Coffee image to TUAT login pages, causing a request to buymeacoffee.com.

TUF Enhancer inserts GitHub-hosted problem links into inline click handlers without escaping.

Tab Equalizer loads a Google Fonts stylesheet when its equalizer page opens.

Tab Groups to Bookmarks loads its popup icon stylesheet from cdnjs.cloudflare.com when you open the popup.

Tab Lasso loads Google Fonts from its new tab page, sending request metadata to Google font domains.

Tab Lock - Secure Any Website Easily lets webpages remove its lock overlay by posting a WXT content-script marker.

Tab Modifier lets webpages trigger its tab-management shortcuts with synthetic keyboard events.

Tab Redesign stores login and payment identity from matching browser tab URLs without verifying the callback origin.

Tab for Google Tasks loads a Wikimedia-hosted image whenever its Google Tasks page script runs.

TabBoost removes iframe and content-security headers from pages and subframes by default.

TabXpert sends tab favicon URLs to i.tabxpert.com when non-paid users view the new tab page.

Tagmate Tracker sends Google Search query terms with a persistent extension client ID to Google Analytics.

Tanjiro Kamado Kimetsu No Yaiba Gameograf loads vendor-controlled HTML into its new tab page.

Tanjiro Kamado Kimetsu No Yaiba Gameograf renders remote popup HTML inside its new-tab page.

Taobao Image Downloader lets any website ask the extension to open attacker-chosen tabs or windows.

Telegram downloader copies the user's premium license code into Telegram Web localStorage.

Testportal And Moodle Agent sends review-page answers and selected element screenshots to moodlea.com.

Text Shortcuts expands page-triggered shortcuts into saved snippets on every website.

The Batman Wallpaper New Tab sends top visited site URLs to Google's favicon service on the new-tab page.

The Education District forwards allowed page messages to a native host on the user's device.

The Lord of the Rings Live Wallpaper fetches remote HTML from Gameograf and renders it inside its new-tab page.

TikTok Unfollow Tool loads remote stylesheets from cdnjs and Google Fonts when its popup opens.

TimeComments sends each YouTube video ID with your Chrome profile email or Google account ID to timecomments.com.

ToDiagram lets its editor pages retrieve selected text and page titles saved for diagram editing.

TokGPT - ChatGPT for TikTok lets any website send TikTok subtitles through your ChatGPT session.

Tokopedia Data Scraper - Product, Sales copies full page HTML from every HTTP or HTTPS site into its extension runtime.

Tokyo Ghoul Wallpaper sends most-visited site domains to Google when its new-tab page shows favicons.

Tophatter - Shopping Rewards sends visited page URLs and some product details to tophatter.com under remote config control.

Toyota Supra Neon Night Road Live Wallpaper sends configured shortcut destination URLs to Google's favicon service.

TradingView Strategy Optimizer sends signed account identifiers to Quant Trading Pro APIs using a bundled secret.

Translate Flashcards sends usage events and phrasebook metadata to Google Analytics.

Translate PDF removes security headers from Google Translate and Google consent pages as they load.

Translate Spanish to English sends selected, clicked, or hovered page text to Google Translate for translation.

Trippy Circles sends new tab search queries with persistent extension identifiers to search.trippycircles.net.

True Colour Match by TCI lets any website trigger its billing-cancel page to reactivate a stored tab and reinject its content script.

Trufflepiggy - Quick Search removes CSP and X-Frame-Options headers from pages and embedded frames.

Tubelator sends YouTube pageview, URL, referrer, and transcript action telemetry to tai.tubelator.com.

Turbo Ad Finder 2.0 sends supported social and ad-library page URLs with persistent identifiers to an Aliyun logstore.

TurboType lets any web page trigger its message bridge to clear snippet state or start an authenticated snippet sync.

TweetPeek AI periodically sends the user's X handle, license email/key, and growth counters to backend.tweetpeek.ai.

Twitch Ads Blocker sends the Twitch channel you are watching to pxy.blocktwitchads.com for fallback playlists.