Low risk browser extensions

Wallpapers Clan sends top-site hostnames to Google's favicon service when building new-tab shortcuts.

Warface Visuals sends Warface character nicknames to system.buh-profit.com on Warface page loads.

WatchMates accepts WebRTC signaling messages from any website and forwards them to watchmates-web.onrender.com.

Watermelon Game fetches remote settings from yoki.games that can open server-supplied URLs on first install.

Wealthbox CRM for Chrome includes hardcoded BrowserStack credentials in its production bundles.

Weather & Time (multi-city) sends city searches to HERE and saved city coordinates to OpenWeather for forecasts.

Web Adblock - Ad Blocker sends the active tab URL, browser, and OS to a Google Apps Script support endpoint.

WebControl fetches its tab-blocking policy over plaintext HTTP and applies it to redirect or close matching tabs.

WebP and AVIF Highlighter refetches page image URLs with extension permissions to classify their codecs.

WebStickies sends aggregate note-storage counts and login status from its list view to Mixpanel.

WhaZiper sends your Google profile email and WhatsApp number to whaziper.com during first-run setup.

Whatnot Spy | Resellbot sends Whatnot page URLs and page metadata to Google Analytics.

WhatsApp Web Side Panel - Tabbee removes WhatsApp frame protections when loading web.whatsapp.com.

Whisk 자동화 도구 by 엔라이트랩 includes a recoverable monthly popup password in its shipped JavaScript.

Wild Life sends new-tab searches to a remotely configured search destination.

Woningstats sends viewed Funda listing addresses to api.pdok.nl to resolve property location data.

World Time loads HTML and links from linangdata.com into its popup and opens server-supplied links in new tabs.

Writeseed - Smart AI Assistant writes the same extension user ID into page storage on every HTTP(S) site.

XSLT Tester loads HTML from linangdata.com into its popup on every open and opens server-chosen links in new tabs.

YIMA sends each visited site's host to ScamAdviser for reputation checks and includes an embedded API key.

YTofMP3 loads Font Awesome CSS from cdnjs.cloudflare.com when its popup opens.

Yay! Another Speed dial! requests saved speed-dial hostnames from img.logo.dev when the new tab page loads.

Yonyx Interactive Decision Tree lets websites send captured fields into its side panel and Yonyx launch URL.

The extension lets any website open an incognito popup to a page-chosen URL.

YouTube Ad Skipper stores ad-skip and hidden-banner counters in YouTube page localStorage.

YouTube Detoxifier sends anonymous click analytics to its Azure-hosted server when timers or settings are used.

YouTube Genius fetches Genius embed code and injects Genius-delivered scripts into YouTube pages.

YouTube Productivity Filter sends YouTube video IDs to Google APIs while checking watch pages.

YouTube Remote lets anyone with the six-letter pairing ID control playback and receive media metadata.

YouTube Transcript Generator loads a remote image from statics.imgkits.com on YouTube watch pages.

Youtube Channels To CSV displays message HTML fetched from its Firebase database inside the extension popup.

Youtube Party opens a Socket.IO connection to redirect.youtubeparty.com on YouTube page loads.

Youtube Video Summary sends YouTube transcripts and video metadata to ChatGPT for automatic summarization.

Zenitsu Agatsuma Live Wallpaper sends saved new-tab shortcut URLs to Google's favicon endpoint.

Zintlr Sales can send full page HTML from pages with LinkedIn-style URL paths to extension.zintlr.com.

Zistemo extension sends a bundled API key with requests to api.zistemo.com.

Zotero DOI PDF Finder loads remote Bootstrap CSS from StackPath when its popup opens.

[Amazon] show price without fees sends the signed-in user's saved email to amzshowpricenofee.com on page navigation.

akaBiz Zalo exposes its popup to any site, letting framed pages trigger Zalo contact, group, and tag syncs to app.akabiz.net.

bilibili Ads Remover exposes custom Bilibili filtering keywords to scripts on Bilibili dynamic and profile pages.

chatvideo sends Bilibili video IDs and extracted subtitle data to www.chatvideo.cc.

click to call requests your public IP address to create a persistent uniqueId for its service.

dLcompare sends game and search terms from matched websites to dlcompare.com for price comparison.

e-Cert Extension lets vendor sites and other extensions pass method payloads to a Hongkong Post native signing host.

etailinsights Shopping Cart Analyzer sends the active site URL and a browser fingerprint hash to api.etailinsights.com.

griffel-devtools marks every page frame in sessionStorage when it runs on all URLs.

iByzPaint Editor fetches remote rules that can cover popular websites with a fake browser-support download overlay.

iPanopto accepts RSS video lists from any active-tab URL containing panopto.com and downloads the listed files.

insidebar.ai lets framed AI provider pages receive webpage messages that write text into their prompt boxes.

lavender | new tab sends precise coordinates to OpenWeatherMap when its new-tab weather feature is used.

mpstats.club forwards Wildberries supplier contact phone numbers and supplier IDs to plugin.mpstats.club.

msgboxx opens an authenticated WebSocket to wsapi.msgboxx.io from each visited top-level page.

n8n extension for Chrome loads its popup icon stylesheet from unpkg.com when the popup opens.

nTab signs its ntab.dev API requests with a hardcoded key embedded in the extension.

nVampeta replaces images on every website with remote Imgur images, causing browsing-time requests to i.imgur.com.

nuTab sends saved bookmark hostnames to icon.horse when it loads remote favicon images.

pipebox stores a page-supplied token as its account token and sends it to api.pipebox.pro.

sip lets any HTTPS page read its wallet settings through a hardcoded bridge namespace.

studyfoc.us lets any website enable time-spent tracking and forward visited hostnames to StudyFoc.us pages.

tab.pics fetches new-tab photo metadata over HTTP from tab.pics for the selected subreddit.