Low risk browser extensions

Stanford GSB Library Chrome Extension sends a persistent extension user ID and popup activity to Google Analytics.

Automatic message translation sends Pro-tier DeepL and AI translation requests over plain HTTP, including message text and the user's session token.

Sidebar for YouTube removes YouTube frame-blocking headers from subframe responses across browsing contexts.

Extended works with Paramount Plus reports your account email and viewing activity to servers unrelated to Paramount every 5 minutes.

Pomodoro Technique Timer periodically sends a persistent generated device ID to its license server.

FBA Calculator for Amazon FBA Sellers accepts a login API key from any postMessage sender on Amazon pages, with no origin check.

Total Privacy For WhatsApp Web loads Google Fonts and Buy Me a Coffee resources when its popup opens.

Super Megavendas sends user-selected WhatsApp chat transcripts to Google Gemini for AI conversation analysis.

AIChatOne strips X-Frame-Options and CSP headers on ChatGPT, Google, Perplexity, and lmarena.ai on any page load, not just its own chat panel.

OnlineShoppingTools queries its own coupon database on every site you visit and opens hidden background tabs to insert affiliate cookies when you copy a code.

YAML Validator sends usage telemetry to PostHog despite its store listing claiming your data never leaves your machine.

YouTube Comment Navigator injects a script that fetches attacker-chosen URLs with your YouTube cookies on unchecked postMessage requests.

CGI US Visa Appointment Auto Rescheduler stores your portal password and security answers in plaintext via Google Chrome Sync.

Wall Smash Game sends popup page-view details and a persistent client ID to Google Analytics when the popup loads.

Sora Video Downloader loads a cdnjs Font Awesome stylesheet on OpenAI and Sora pages.

DSMATEPRO lets any script running on aliexpress.com or aliexpress.us fetch an arbitrary URL through the extension and read the response.

Engage AI exposes a Facebook-session bridge to any page loaded from http://localhost:9000 with no additional token check.

HTnini writes its extension runtime ID into the Hattrick page DOM when its in-page UI opens.

Live Wallpaper: Gojo Hollow Purple silently tags every New Tab search to Google or Bing with a hidden affiliate tracking code.

GrabzIt Web Scraping Assistant sends the user's live GrabzIt account key to a third-party analytics service on popup errors.

Reyohoho Twitch Extension(Nightly) sends your Twitch account ID and the channel you're watching to its own server every 10 minutes.

Useful's bundled Markdown editor loads highlight.js, KaTeX, and other libraries from cdnjs.cloudflare.com without integrity checks.

Kipper's page-injected message listener accepts wallet and tip-reply commands from any website without checking the sender's origin.

Film Scores for HBO Max sends the user's Max account details and viewing history to third-party servers on every page load.

Reaction Exporter taps Facebook's GraphQL API to bulk-collect reactor/commenter names beyond the UI, for local CSV/XLSX export.

CAD Viewer accepts an auth token from any page on localhost, not just its own login page, and stores it as the user's session.

Energy8 Wallet disguises its Solana RPC traffic as coming from Trust Wallet, a competing extension.

Goku Watching Sunset Dragon Ball tags every Google and Bing search made from its new-tab page with a hardcoded affiliate ID.

Cassou accepts a postMessage from any sender and writes its cookie field into the page's cookies without checking the message's origin.

Tubi: Picture in Picture reads your Tubi viewing history and profile data and sends them to a third-party server, metricmuse.xyz.

DownPictures injects a remote-controlled floating button and menu on every website, redirecting to Alibaba/1688.com affiliate links.

Apple TV Picture In Picture reads the signed-in user's Apple ID email and sends it to third-party servers.

Sapling's writing assistant loads and runs unsigned code from its own server on Amazon Connect contact-center pages.

TestWhiz listens for a page-posted LOGIN_SUCCESS message with no origin check and stores the supplied userId on every site.

ezyConneqt reads your LinkedIn session cookies to make authenticated API calls that collect profile data and sends it to ezyHire's servers.

Word Search Game sends popup page titles, popup URLs, and persistent session identifiers to Google Analytics.

This Hulu.jp picture-in-picture extension also scrapes U-NEXT account and watch history and uploads it to a third-party server.

CFCA CertEnrollment.JLBank Extension connects to a caller-chosen native messaging host and relays the caller's payload with no allowlist.

Web for Telegram renders a remote message from its developer's server into the page without sanitizing it on first display.

Friends Remover sends the raw PIN or password for its optional Security Lock feature to a third-party server unhashed.

123Movies scans pages that merely look like IMDb listings and fetches matching stream links from vidsrc.xyz.

Web for Google Messages polls the developer's own server on startup and can show OS-level notifications with a developer-controlled link.

EXP Anti Detect Browser Free writes its spoofed IP, location, timezone, and language profile into page-readable localStorage on every site.

Type Keeper logs every keystroke and clipboard action on all sites and stores the log locally with weak at-rest encryption.

Windmill base64-encodes the user's proxy account password into a request header sent to a remote-configured server every 5 minutes.

Auto Answer Edunext ships six hardcoded Groq API keys in its code as a shared fallback pool for AI requests.

Balloon Pop Game sends popup page-view metadata and persistent extension usage IDs to Google Analytics.

Pinterest Image Scraper Downloader stores the email from any tab's login or payment callback URL, without checking its real origin.

TikVPN derives a persistent device ID from a canvas fingerprint and sends it with every backend request.

View PDF's new tab search streams every keystroke to viewpdf.org and redirects results through a monetized ad network.

Ctool 程序开发常用工具 sends a beacon to its own server every time you open one of its dev tools, tagged with a persistent user ID.

Extrovert reads your LinkedIn session cookies (li_at and premium li_a) and sends them to its own vendor backend.

Hot.Game+ swaps in its own affiliate IDs on ~15 partner game stores, auto-enabled with no prompt on Opera, Yandex and Vivaldi.

Mercado Livre Clips Downloader watches network requests on every site, not just Mercado Livre, and reports video-stream hostnames to Sentry.

Whatfix for Shell removes the X-Frame-Options and Content-Security-Policy headers from every page you visit.

WA-CRM patches WhatsApp Web's link-preview function to send every URL typed in a chat to third-party preview servers first.

FirstSlotsAlert stores your visa-portal login and security-question answers in plaintext local storage for autofill.

Send to qBittorrent stores your WebUI host, username, and password in plaintext via Chrome Sync.

Prospecta fingerprints the browser and combines it with the Chrome-signed-in email and IP location on every side-panel open.

SNS Assistant | Instagram Threads overrides confirm, prompt, and alert dialogs on every blog.naver.com page it loads on.