Low risk browser extensions

크림헬퍼SIBNA sends Kream product page URLs and product titles to 18nike.com.

Automatic Messenger Translator sends Facebook Messenger message text over plain HTTP when using its DeepL or GPT translation options.

Taobao Tmall Data Scraper captures and attempts to send the full HTML of every website you visit, not just Taobao or Tmall.

GaiaUpgrade sends avatar image URLs to cors-fix.web.app when exporting saved avatar images.

Text to Speech (TTS) posts a persistent user ID and browser-language details to push.freebusinessapps.net.

GitHub Accelerator routes GitHub downloads through third-party proxy nodes whose 'integrity check' never verifies the downloaded file.

AutoDraw for skribbl.io sends dropped image URLs to a Cloudflare Worker proxy when direct image loading fails.

Etsy Price Tracker reports matching Etsy URLs to Aliprice and can rewrite Etsy links through Aliprice redirects.

Star Match Game sends popup page-view telemetry with a persistent client ID to Google Analytics.

Stanford GSB Library Chrome Extension sends a persistent extension user ID and popup activity to Google Analytics.

Sidebar for YouTube removes YouTube frame-blocking headers from subframe responses across browsing contexts.

Saving Button accepts a page cookie as its login token and sends it to api.inspiri.ng for account and offer requests.

Extended works with Paramount Plus reports your account email and viewing activity to servers unrelated to Paramount every 5 minutes.

Pomodoro Technique Timer periodically sends a persistent generated device ID to its license server.

OnlineShoppingTools queries its own coupon database on every site you visit and opens hidden background tabs to insert affiliate cookies when you copy a code.

YAML Validator sends usage telemetry to PostHog despite its store listing claiming your data never leaves your machine.

Wall Smash Game sends popup page-view details and a persistent client ID to Google Analytics when the popup loads.

Engage AI exposes a Facebook-session bridge to any page loaded from http://localhost:9000 with no additional token check.

HTnini writes its extension runtime ID into the Hattrick page DOM when its in-page UI opens.

Goku Watching Sunset Dragon Ball tags every Google and Bing search made from its new-tab page with a hardcoded affiliate ID.

Reyohoho Twitch Extension(Nightly) sends your Twitch account ID and the channel you're watching to its own server every 10 minutes.

Live Wallpaper: Gojo Hollow Purple silently tags every New Tab search to Google or Bing with a hidden affiliate tracking code.

Useful's bundled Markdown editor loads highlight.js, KaTeX, and other libraries from cdnjs.cloudflare.com without integrity checks.

Film Scores for HBO Max sends the user's Max account details and viewing history to third-party servers on every page load.

Reaction Exporter taps Facebook's GraphQL API to bulk-collect reactor/commenter names beyond the UI, for local CSV/XLSX export.

Sapling's writing assistant loads and runs unsigned code from its own server on Amazon Connect contact-center pages.

Tubi: Picture in Picture reads your Tubi viewing history and profile data and sends them to a third-party server, metricmuse.xyz.

Apple TV Picture In Picture reads the signed-in user's Apple ID email and sends it to third-party servers.

CGI US Visa Appointment Auto Rescheduler stores your portal password and security answers in plaintext via Google Chrome Sync.

TestWhiz listens for a page-posted LOGIN_SUCCESS message with no origin check and stores the supplied userId on every site.

ezyConneqt reads your LinkedIn session cookies to make authenticated API calls that collect profile data and sends it to ezyHire's servers.

DownPictures injects a remote-controlled floating button and menu on every website, redirecting to Alibaba/1688.com affiliate links.

Word Search Game sends popup page titles, popup URLs, and persistent session identifiers to Google Analytics.

This Hulu.jp picture-in-picture extension also scrapes U-NEXT account and watch history and uploads it to a third-party server.

CFCA CertEnrollment.JLBank Extension connects to a caller-chosen native messaging host and relays the caller's payload with no allowlist.

123Movies scans pages that merely look like IMDb listings and fetches matching stream links from vidsrc.xyz.

Web for Telegram renders a remote message from its developer's server into the page without sanitizing it on first display.

Type Keeper logs every keystroke and clipboard action on all sites and stores the log locally with weak at-rest encryption.

Web for Google Messages polls the developer's own server on startup and can show OS-level notifications with a developer-controlled link.

Balloon Pop Game sends popup page-view metadata and persistent extension usage IDs to Google Analytics.

Ctool 程序开发常用工具 sends a beacon to its own server every time you open one of its dev tools, tagged with a persistent user ID.

Pinterest Image Scraper Downloader stores the email from any tab's login or payment callback URL, without checking its real origin.

Extrovert reads your LinkedIn session cookies (li_at and premium li_a) and sends them to its own vendor backend.

Mercado Livre Clips Downloader watches network requests on every site, not just Mercado Livre, and reports video-stream hostnames to Sentry.

Windmill base64-encodes the user's proxy account password into a request header sent to a remote-configured server every 5 minutes.

Price Tracker sends the URL of your active tab to prictr.com every time you open its popup, on any site.

SNS Assistant | Instagram Threads overrides confirm, prompt, and alert dialogs on every blog.naver.com page it loads on.

Smarty's opt-in Amazon Price Protection feature opens a hidden tab to scrape your Amazon order history and sends it to Smarty's servers.

Automatic IG Translator sends Instagram DM text and your Pro login token over plain HTTP to its translation server.

FeHelper wires a remote code-execution hook into every tool page; dormant in this build, but only the vendor can ever populate it.

Video Bender sends your Paramount+ profile, viewing, and account data to remote servers every 5 minutes while you're logged in.

Any Downloader Pro sends visited page URLs and titles to its Supabase backend when remote analytics is enabled.

Classi AI 학생 sends the student's browsing history, Gemini AI chat content, and live screen/camera to a teacher dashboard.

Labubu Dance Live Wallpaper renders remote HTML from its own server directly into the new tab page with no sanitization.

Amazon Review Scraper Downloader reports the Amazon product URL to a third-party server every time a review CSV is exported.

Pic-in-Pic Floating Window periodically fetches your Google account activity and profile data and sends it to metricmuse.xyz.

NYT Reader sends your Chrome profile email, device fingerprint, and NYT article count to api.gethogrider.com.

Temu Downloader sends the user's Google account email to a third-party monetization backend to check subscription status.

CNN U.S. inserts news feed content from notifiernews.com into its popup using unescaped HTML.

Viaplay: Picture in Picture uses your active Google session on an hourly timer to scrape your YouTube activity history and account profile.