Low risk browser extensions

Price Tracker sends the URL of your active tab to prictr.com every time you open its popup, on any site.

FeHelper wires a remote code-execution hook into every tool page; dormant in this build, but only the vendor can ever populate it.

Smarty's opt-in Amazon Price Protection feature opens a hidden tab to scrape your Amazon order history and sends it to Smarty's servers.

Check US Visa Slots stores your visa-portal username, password, and security-question answers in plaintext.

Automatic IG Translator sends Instagram DM text and your Pro login token over plain HTTP to its translation server.

APM Music's content script replies to any postMessage sender with the page's login state, current track, and playback URL.

AliSaving watches for a Facebook Pixel subscribe event and silently visits its own AliExpress affiliate link to claim commission.

Perplexity Exporter accepts account updates from any extension with no sender check, letting one forge its cached subscription data.

Companion for Reddit renders operator-controlled messages from its own server as raw HTML, skipping sanitization on the first render.

Highlightion accepts your Notion login token from a local port with no origin check, and sends every page you visit to Google Analytics.

Video Bender sends your Paramount+ profile, viewing, and account data to remote servers every 5 minutes while you're logged in.

White Messenger renders remote message text as raw HTML into web.skype.com and Outlook.com pages before any sanitization runs.

Any Downloader Pro sends visited page URLs and titles to its Supabase backend when remote analytics is enabled.

Labubu Dance Live Wallpaper renders remote HTML from its own server directly into the new tab page with no sanitization.

Amazon Review Scraper Downloader reports the Amazon product URL to a third-party server every time a review CSV is exported.

Pic-in-Pic Floating Window periodically fetches your Google account activity and profile data and sends it to metricmuse.xyz.

Classi AI 학생 sends the student's browsing history, Gemini AI chat content, and live screen/camera to a teacher dashboard.

NYT Reader sends your Chrome profile email, device fingerprint, and NYT article count to api.gethogrider.com.

News Hub kiosk renders operator-controlled remote message text into the page as raw HTML before any sanitization runs.

Temu Downloader sends the user's Google account email to a third-party monetization backend to check subscription status.

CNN U.S. inserts news feed content from notifiernews.com into its popup using unescaped HTML.

Twitter X Viewer registers browser and extension metadata with its vendor endpoint on install and browser startup.

Viaplay: Picture in Picture uses your active Google session on an hourly timer to scrape your YouTube activity history and account profile.

WAPP Sender reports every WhatsApp broadcast as 100% delivered to its own backend regardless of what actually happened.

Discord Token Login logs Discord in from a token in a plain URL, accepted from any navigation, not only its own popup.

Message Chatbot captures every text selection on messenger.com and sends it to the vendor's analytics backend.

Savelore accepts dashboard-supplied sync tokens and uses them to upload saved snippets to Supabase.

VPN for Notion fetches its proxy server credentials from unauthenticated GitHub, Blogspot, and Google Docs pages with no integrity check.

Export Gemini Chats to PDF accepts unchecked postMessage on gemini.google.com, letting any page trigger a silent, attacker-chosen download.

SoldScope exposes a background fetch handler to any other installed extension, which can retrieve arbitrary URLs' HTML through it.

Full Page Screenshot broadcasts a stable extension identifier to every web page it runs on.

CaptionGo forges Referer, Origin, and User-Agent headers to impersonate DeepL, Tencent, ByteDance, and Microsoft's own translation apps.

Perfect Sender sends your license key and device identifiers to its server over plain HTTP instead of HTTPS.

X Token Login writes a pasted x.com auth_token value directly into the browser's cookies to log in as that account.

CFCA CryptoKit.XMYLSW Extension lets any xmztb.com page pick the native-messaging host and payload it forwards, with no allowlist.

Ice Spice Wallpapers renders remote JSON content directly into the new tab page's DOM with no sanitization.

Favorites Start Page fetches bookmark and top-site pages to discover favicons for its new-tab page.

DBIRD Dual Subtitles accepts a login token from any web page via its welcome.html page and saves it as the active account.

SLTD - Business Tools Sender relays your WhatsApp message text and sender info to a webhook or CRM endpoint you configure.

AI Assistant for ChatGPT sends your IP address and a persistent device ID to an analytics endpoint on install and update.

perc.pass accepts postMessages from any webpage with no origin check, prefilling a save-password prompt with attacker-chosen credentials.

Price tracker - Otsledit rewrites merchant links you click with its own affiliate parameter for free-tier users.

GroupKii rewrites the Origin and Referer headers to facebook.com on any tab's request to a facebook.com URL, not just its own.

Deal Finder sends your Google search result URLs to Takeads and rewrites matching links into affiliate tracking links.

OmegaChat stores your panel email and plaintext password and resends both as HTTP headers on every automated poll to its backend.

Site Palette accepts an unauthenticated message from any page and adopts whatever token that page supplies as the user's login credential.

RikoSub exposes the user's netflixsubs.app auth token to the page via a wildcard postMessage, readable by any other script sharing the page.

FreeexpressVPN Chrome has no VPN/proxy function and sends the active tab's URL to a third-party geolocation API on every popup open.

X Token Login writes a user-pasted token into x.com's auth_token session cookie, logging the browser in as that token's owner.

The extension sends your Paramount+ account ID, subscription status, and email to metricsmint.quest regardless of the privacy toggle.

Kylian Mbappé MeaVana strips anti-framing headers from sites it embeds in its own new-tab iframes.

Demos Wallet lets any website request Demos identity lookups and sends those requests to demosnode.discus.sh.

ViewGrip generates a canvas/WebGL device fingerprint and sends its hash to viewgrip.net on every YouTube view-boosting worker step.

GrowBot Automator logs every Instagram account it scrapes for follow/like/comment automation to its own server.

SmartPrice Guard rewrites every Amazon product URL and link with its own affiliate tag from a remote server, undisclosed.

Offers.com looks up your current site against its merchant list and fetches matching coupons over plain, unencrypted HTTP.

CaseSnappy Summarizer renders its AI-generated case summary and error messages into the popup via innerHTML without sanitizing them.

AliInvoice remotely rewrites AliExpress product and cart page loads into its own affiliate-tracking link.

Winter Chill HD Wallpapers New Tab lets any page on onlygoodlife.co read your top 100 visited sites and titles with no extra sender check.

Skip Wait lets pages trigger credentialed extension fetches to page-chosen URLs.