Low risk browser extensions

Unblocked Games 76 ships hardcoded proxy credentials and returns them for authentication challenges on game and proxy domains.

UniTap Wallet exposes an unlocked account address to every website before connection approval.

Unicorn Wallpaper sends your Chrome top-sites URLs to Google's favicon service on each new tab.

VINCUE lets pages that open or frame KBB/MMR valuation pages request and receive vehicle valuation details.

VNConvert lets any website ask it to open vnconvert.com and fetch a supplied file URL for conversion.

VPN IP Checker sends popup IP lookups and usage beacons over HTTP when the extension popup opens.

VPN для LinkedIn routes selected site traffic through configured proxy servers when VPN mode is enabled.

Vagabond loads third-party font stylesheets each time its custom new-tab page opens.

Valentines Day Live Wallpaper sends each saved new-tab shortcut URL to Google's favicon service.

The extension lets webpages trigger a preview that strips frame-blocking headers and frames page-chosen URLs.

Viction Wallet embeds a Coin98 API signing secret and third-party RPC API keys in its background bundle.

Video Compressor & Filesize Reducer injects a hidden xeriflow.net iframe into every HTTPS page.

Video Speed Controller Global exposes its synced settings to page scripts on every site through a postMessage bridge.

Video filters for YouTube [QVI] uploads Google and YouTube activity and profile data to metricmuse.xyz.

Visual Bookmarks with All My Faves imports AllMyFaves tokens from tabs whose URLs contain allmyfaves.

VoIPstudio turns phone numbers on webpages into click-to-call links that page scripts can activate.

Vocab Wallet lets vocabwallet.com and localhost:4200 pages request its full local storage object.

Vodori Web Annotation lets matching child frames request credentialed background web fetches through the extension.

WA Biz Sender (Prime) sends your WhatsApp number and Chrome profile email to analytics and feedback services.

WASender sends WhatsApp Web page details and identifiers to Google Analytics.

WHMCS一键下单 sends detected WHMCS and Blesta checkout page URLs to rack.theinspiredgroup.com.

WMTWIN sends Walmart search terms, result-rank details, and product recommendation URLs to www.wmtwin.com.

Wachatbot removes key security and privacy headers from WhatsApp Web pages.

Walcu Pro sends coches.net vehicle listing details to Walcu pricing APIs and inserts Walcu promotional banners.

Wall of Marvel loads its new-tab background image over plaintext HTTP from CloudFront.

Wallpapers Clan sends top-site hostnames to Google's favicon service when building new-tab shortcuts.

Wapes sends WhatsApp Web page-view and session telemetry to Google Analytics.

Warface Visuals sends Warface character nicknames to system.buh-profit.com on Warface page loads.

WatchMates accepts WebRTC signaling messages from any website and forwards them to watchmates-web.onrender.com.

Water And Fire Wolf Live Wallpaper Animation sends new-tab shortcut URLs to Google's favicon service.

Watermelon Game fetches remote settings from yoki.games that can open server-supplied URLs on first install.

Wealthbox CRM for Chrome includes hardcoded BrowserStack credentials in its production bundles.

Weather & Time (multi-city) sends city searches to HERE and saved city coordinates to OpenWeather for forecasts.

Web Adblock - Ad Blocker sends the active tab URL, browser, and OS to a Google Apps Script support endpoint.

WebControl fetches its tab-blocking policy over plaintext HTTP and applies it to redirect or close matching tabs.

WebP and AVIF Highlighter refetches page image URLs with extension permissions to classify their codecs.

WebStickies sends aggregate note-storage counts and login status from its list view to Mixpanel.

Weflow ships production bundles with a hardcoded Sentry auth token embedded in its JavaScript.

WhaZiper sends your Google profile email and WhatsApp number to whaziper.com during first-run setup.

Whatnot Spy | Resellbot sends Whatnot page URLs and page metadata to Google Analytics.

WhatsApp Web Side Panel - Tabbee removes WhatsApp frame protections when loading web.whatsapp.com.

Whisk 자동화 도구 by 엔라이트랩 includes a recoverable monthly popup password in its shipped JavaScript.

Wild Life sends new-tab searches to a remotely configured search destination.

Woningstats sends viewed Funda listing addresses to api.pdok.nl to resolve property location data.

Writeseed - Smart AI Assistant writes the same extension user ID into page storage on every HTTP(S) site.

YIMA sends each visited site's host to ScamAdviser for reputation checks and includes an embedded API key.

YTofMP3 loads Font Awesome CSS from cdnjs.cloudflare.com when its popup opens.

Yay! Another Speed dial! requests saved speed-dial hostnames from img.logo.dev when the new tab page loads.

Yonyx Interactive Decision Tree lets websites send captured fields into its side panel and Yonyx launch URL.

The extension lets any website open an incognito popup to a page-chosen URL.

YouTube Ad Skipper stores ad-skip and hidden-banner counters in YouTube page localStorage.

YouTube Detoxifier sends anonymous click analytics to its Azure-hosted server when timers or settings are used.

YouTube Genius fetches Genius embed code and injects Genius-delivered scripts into YouTube pages.

YouTube Productivity Filter sends YouTube video IDs to Google APIs while checking watch pages.

YouTube Remote lets anyone with the six-letter pairing ID control playback and receive media metadata.

YouTube Transcript Generator loads a remote image from statics.imgkits.com on YouTube watch pages.

Youtube Channels To CSV displays message HTML fetched from its Firebase database inside the extension popup.

Youtube Party opens a Socket.IO connection to redirect.youtubeparty.com on YouTube page loads.

Youtube Video Summary sends YouTube transcripts and video metadata to ChatGPT for automatic summarization.

Zenitsu Agatsuma Live Wallpaper sends saved new-tab shortcut URLs to Google's favicon endpoint.