Low risk browser extensions

AIChatOne strips X-Frame-Options and CSP headers on ChatGPT, Google, Perplexity, and lmarena.ai on any page load, not just its own chat panel.

ezyConneqt reads your LinkedIn session cookies to make authenticated API calls that collect profile data and sends it to ezyHire's servers.

OnlineShoppingTools queries its own coupon database on every site you visit and opens hidden background tabs to insert affiliate cookies when you copy a code.

Total Privacy For WhatsApp Web loads Google Fonts and Buy Me a Coffee resources when its popup opens.

YAML Validator sends usage telemetry to PostHog despite its store listing claiming your data never leaves your machine.

YouTube Comment Navigator injects a script that fetches attacker-chosen URLs with your YouTube cookies on unchecked postMessage requests.

Comics Translator reports the page URL and image URL, with your Google email as ID, to Alibaba Cloud telemetry on each translation.

Wall Smash Game sends popup page-view details and a persistent client ID to Google Analytics when the popup loads.

Angry Birds Side panel MeaVana removes CSP and frame-blocking headers from responses on every site you visit.

Super Megavendas sends user-selected WhatsApp chat transcripts to Google Gemini for AI conversation analysis.

LinkedIn Video Downloader sends the user's signed-in Google account email to an unrelated third-party licensing server.

Cashyo coupon extension lets scripts on retailer pages list and enable or disable installed extensions.

The extension fetches HTML from exad.rangtaobaofei.com and injects it into AliExpress pages as live markup.

WA Sender uploads recipient phone numbers and message text from every WhatsApp send to the vendor's Firebase backend.

HBO Max SubStyler enables viewing-data sharing by default and sends Max profile and watch data to its servers.

Everything to Notebook extracts text, subtitles, and images from supported pages and syncs them to Notion, Feishu, NotebookLM, or Obsidian.

DSMATEPRO lets any script running on aliexpress.com or aliexpress.us fetch an arbitrary URL through the extension and read the response.

Lạc Đà Việt rewrites marketplace product links on every page and uploads product data from visited shop pages.

Download Temu Images & Videos lets any web page trigger its image-search upload feature through an unchecked message listener.

The extension sends shopping links from every page to its own servers and rewrites them with returned URLs.

One Piece Anime Wallpapers New Tab fetches a remote config on install and can open a server-chosen tab.

Engage AI exposes a Facebook-session bridge to any page loaded from http://localhost:9000 with no additional token check.

Weather Forecast loads HTML and links from linangdata.com into its popup and opens server-chosen tabs.

Web View sets find.webplannerview.com as the default search and appends tracking parameters to each search.

Rivia sends every API request and recorded event, including typed input text, to the LogDNA logging service.

KINETK IP Network uploads images, video and audio from sites you visit, with page URL and wallet address, to api.kinetk.ai.

Docutracks Signer forwards page-fired 'signFileHash' events from any site to a local native signing host.

GrabzIt Web Scraping Assistant sends the user's live GrabzIt account key to a third-party analytics service on popup errors.

Reyohoho Twitch Extension(Nightly) sends your Twitch account ID and the channel you're watching to its own server every 10 minutes.

AutoNext submits zero-score peer grades to FPT EduNext for every group the student belongs to.

DownPictures injects a remote-controlled floating button and menu on every website, redirecting to Alibaba/1688.com affiliate links.

Bot BinGo sends your Binomo account ID to kibertrader.com to check affiliate status before unlocking its trading bot.

AutoQwen sends your Qwen chat prompts and account email to its own server on a remotely configured sample of sessions.

HTnini writes its extension runtime ID into the Hattrick page DOM when its in-page UI opens.

Useful's bundled Markdown editor loads highlight.js, KaTeX, and other libraries from cdnjs.cloudflare.com without integrity checks.

Kipper's page-injected message listener accepts wallet and tip-reply commands from any website without checking the sender's origin.

Film Scores for HBO Max sends the user's Max account details and viewing history to third-party servers on every page load.

ZaubaCorp Scraper Tool uploads finished company-scrape results and your search query to scrappertool.com.

Reaction Exporter taps Facebook's GraphQL API to bulk-collect reactor/commenter names beyond the UI, for local CSV/XLSX export.

Aub's Omnipotent Image Translator sends your Google account email and the page URL to Alibaba telemetry on each translate.

CAD Viewer accepts an auth token from any page on localhost, not just its own login page, and stores it as the user's session.

Energy8 Wallet disguises its Solana RPC traffic as coming from Trust Wallet, a competing extension.

Cassou accepts a postMessage from any sender and writes its cookie field into the page's cookies without checking the message's origin.

Free YouTube Dubbing & Translation reads YouTube video subtitles and sends text to translation and speech APIs.

Tubi: Picture in Picture reads your Tubi viewing history and profile data and sends them to a third-party server, metricmuse.xyz.

Apple TV Picture In Picture reads the signed-in user's Apple ID email and sends it to third-party servers.

Etikimza relays any web page's requests to a local PKCS#11 smartcard host, including certificate listing and signing.

The extension sends Taobao, Tmall and 1688 product links from every page you visit to cashback.gobiz.dev and rewrites them.

Goku Watching Sunset Dragon Ball tags every Google and Bing search made from its new-tab page with a hardcoded affiliate ID.

TestWhiz listens for a page-posted LOGIN_SUCCESS message with no origin check and stores the supplied userId on every site.

Smart WA Sender Pro sends your Google profile email and WhatsApp number to the vendor's Google Analytics property.

Live Wallpaper: Gojo Hollow Purple silently tags every New Tab search to Google or Bing with a hidden affiliate tracking code.

Word Search Game sends popup page titles, popup URLs, and persistent session identifiers to Google Analytics.

Web for Telegram renders a remote message from its developer's server into the page without sanitizing it on first display.

This Hulu.jp picture-in-picture extension also scrapes U-NEXT account and watch history and uploads it to a third-party server.

Catena Wallet derives its vault encryption key with only 10,000 PBKDF2 iterations, well below modern guidance.

CFCA CertEnrollment.JLBank Extension connects to a caller-chosen native messaging host and relays the caller's payload with no allowlist.

Keyboard shortcuts for HBO Max uploads your Max viewing history and profile details to third-party servers, on by default.

The extension rewrites Taobao, Tmall, 1688 and Pinduoduo product links on every page into cashback tracking URLs from its server.

Manga Translator sends your Google account email, page URL and image URL to Alibaba Cloud ARMS on each image translation.