Low risk browser extensions

Twitter Extension stores the configured username filter list in Twitter page localStorage.

Typing Statistics | Auto Typer records per-site keypress statistics from every site in local extension storage.

The extension opens an adpvn.co affiliate popup when downloading images from Lazada product pages.

UPC Lookup sends the Chrome profile email to dropshipping-ext.parallelloop.io before explicit sign-in.

UPlog红薯助手 posts authenticated Feishu document contents to the page that embeds the document frame.

URL Shortener Plus sends the active tab URL to TinyURL when the popup creates a short link.

UTSniper copies its bearer token into EA Web App localStorage where page scripts can read it.

UW Madison - Course Search & Enroll + sends selected course identifiers to Madgrades with a bundled API token.

UW Wave lets uwwave.ca and any *.vercel.app page read and modify its extension storage.

UltraWide for YouTube polls MetricMuse for commands that collect Google, YouTube, and UNext profile data and viewing history.

Unblocked Games 76 ships hardcoded proxy credentials and returns them for authentication challenges on game and proxy domains.

UniTap Wallet exposes an unlocked account address to every website before connection approval.

Unicorn Wallpaper sends your Chrome top-sites URLs to Google's favicon service on each new tab.

VINCUE lets pages that open or frame KBB/MMR valuation pages request and receive vehicle valuation details.

VNConvert lets any website ask it to open vnconvert.com and fetch a supplied file URL for conversion.

VPN IP Checker sends popup IP lookups and usage beacons over HTTP when the extension popup opens.

VPN для LinkedIn routes selected site traffic through configured proxy servers when VPN mode is enabled.

Vagabond loads third-party font stylesheets each time its custom new-tab page opens.

Valentines Day Live Wallpaper sends each saved new-tab shortcut URL to Google's favicon service.

The extension lets webpages trigger a preview that strips frame-blocking headers and frames page-chosen URLs.

Viction Wallet embeds a Coin98 API signing secret and third-party RPC API keys in its background bundle.

Video Compressor & Filesize Reducer injects a hidden xeriflow.net iframe into every HTTPS page.

Video Speed Controller Global exposes its synced settings to page scripts on every site through a postMessage bridge.

Video filters for YouTube [QVI] uploads Google and YouTube activity and profile data to metricmuse.xyz.

Visual Bookmarks with All My Faves imports AllMyFaves tokens from tabs whose URLs contain allmyfaves.

VoIPstudio turns phone numbers on webpages into click-to-call links that page scripts can activate.

Vocab Wallet lets vocabwallet.com and localhost:4200 pages request its full local storage object.

Vodori Web Annotation lets matching child frames request credentialed background web fetches through the extension.

WA Biz Sender (Prime) sends your WhatsApp number and Chrome profile email to analytics and feedback services.

WASender sends WhatsApp Web page details and identifiers to Google Analytics.

WHMCS一键下单 sends detected WHMCS and Blesta checkout page URLs to rack.theinspiredgroup.com.

WMTWIN sends Walmart search terms, result-rank details, and product recommendation URLs to www.wmtwin.com.

Wachatbot removes key security and privacy headers from WhatsApp Web pages.

Walcu Pro sends coches.net vehicle listing details to Walcu pricing APIs and inserts Walcu promotional banners.

Wall of Marvel loads its new-tab background image over plaintext HTTP from CloudFront.

Wallpapers Clan sends top-site hostnames to Google's favicon service when building new-tab shortcuts.

Wapes sends WhatsApp Web page-view and session telemetry to Google Analytics.

Warface Visuals sends Warface character nicknames to system.buh-profit.com on Warface page loads.

WatchMates accepts WebRTC signaling messages from any website and forwards them to watchmates-web.onrender.com.

Water And Fire Wolf Live Wallpaper Animation sends new-tab shortcut URLs to Google's favicon service.

Watermelon Game fetches remote settings from yoki.games that can open server-supplied URLs on first install.

Wealthbox CRM for Chrome includes hardcoded BrowserStack credentials in its production bundles.

Weather & Time (multi-city) sends city searches to HERE and saved city coordinates to OpenWeather for forecasts.

Web Adblock - Ad Blocker sends the active tab URL, browser, and OS to a Google Apps Script support endpoint.

WebControl fetches its tab-blocking policy over plaintext HTTP and applies it to redirect or close matching tabs.

WebP and AVIF Highlighter refetches page image URLs with extension permissions to classify their codecs.

WebStickies sends aggregate note-storage counts and login status from its list view to Mixpanel.

Weflow ships production bundles with a hardcoded Sentry auth token embedded in its JavaScript.

WhaZiper sends your Google profile email and WhatsApp number to whaziper.com during first-run setup.

Whatnot Spy | Resellbot sends Whatnot page URLs and page metadata to Google Analytics.

WhatsApp Web Side Panel - Tabbee removes WhatsApp frame protections when loading web.whatsapp.com.

Whisk 자동화 도구 by 엔라이트랩 includes a recoverable monthly popup password in its shipped JavaScript.

Wild Life sends new-tab searches to a remotely configured search destination.

Woningstats sends viewed Funda listing addresses to api.pdok.nl to resolve property location data.

Writeseed - Smart AI Assistant writes the same extension user ID into page storage on every HTTP(S) site.

YIMA sends each visited site's host to ScamAdviser for reputation checks and includes an embedded API key.

YT Remote sends the signed-in Chrome profile email to its Supabase endpoint when the background script starts.

YTofMP3 loads Font Awesome CSS from cdnjs.cloudflare.com when its popup opens.

Yay! Another Speed dial! requests saved speed-dial hostnames from img.logo.dev when the new tab page loads.

Yonyx Interactive Decision Tree lets websites send captured fields into its side panel and Yonyx launch URL.