Low risk browser extensions

Valentines Day Live Wallpaper sends each saved new-tab shortcut URL to Google's favicon service.

Velocity sends signed-in users' ChatGPT, Claude, and Gemini chat transcripts to ThinkVelocity ContextEngine.

Vibes lets any webpage relay an internal event that starts tab audio capture through the extension.

Viction Wallet embeds a Coin98 API signing secret and third-party RPC API keys in its background bundle.

Video Compressor & Filesize Reducer injects a hidden xeriflow.net iframe into every HTTPS page.

Video Speed Controller Global exposes its synced settings to page scripts on every site through a postMessage bridge.

Video filters for YouTube [QVI] uploads Google and YouTube activity and profile data to metricmuse.xyz.

Viinyx exposes a web-accessible PDF worker that can fetch caller-supplied PDF URLs and return extracted text to the page.

Visibrow sends active and completed tab URLs to its categorization endpoint.

Visual Bookmarks with All My Faves imports AllMyFaves tokens from tabs whose URLs contain allmyfaves.

VoIPstudio turns phone numbers on webpages into click-to-call links that page scripts can activate.

Vocab Wallet lets vocabwallet.com and localhost:4200 pages request its full local storage object.

Vodori Web Annotation lets matching child frames request credentialed background web fetches through the extension.

WA Biz Sender (Prime) sends your WhatsApp number and Chrome profile email to analytics and feedback services.

WASender sends WhatsApp Web page details and identifiers to Google Analytics.

WHMCS一键下单 sends detected WHMCS and Blesta checkout page URLs to rack.theinspiredgroup.com.

WMTWIN sends Walmart search terms, result-rank details, and product recommendation URLs to www.wmtwin.com.

Wachatbot removes key security and privacy headers from WhatsApp Web pages.

Walcu Pro sends coches.net vehicle listing details to Walcu pricing APIs and inserts Walcu promotional banners.

Wall of Marvel loads its new-tab background image over plaintext HTTP from CloudFront.

Wallpapers Clan sends top-site hostnames to Google's favicon service when building new-tab shortcuts.

Wander BETA forwards wallet API messages from all frames without checking the page origin.

Warface Visuals sends Warface character nicknames to system.buh-profit.com on Warface page loads.

WatchMates accepts WebRTC signaling messages from any website and forwards them to watchmates-web.onrender.com.

Watermelon Game fetches remote settings from yoki.games that can open server-supplied URLs on first install.

Wealthbox CRM for Chrome includes hardcoded BrowserStack credentials in its production bundles.

Weather & Time (multi-city) sends city searches to HERE and saved city coordinates to OpenWeather for forecasts.

Web Adblock - Ad Blocker sends the active tab URL, browser, and OS to a Google Apps Script support endpoint.

WebControl fetches its tab-blocking policy over plaintext HTTP and applies it to redirect or close matching tabs.

WebP and AVIF Highlighter refetches page image URLs with extension permissions to classify their codecs.

WebStickies sends aggregate note-storage counts and login status from its list view to Mixpanel.

Webpage to PDF by cloudHQ lists every Google account signed in to your browser and sends the list to cloudHQ when Gmail loads.

WhaZiper sends your Google profile email and WhatsApp number to whaziper.com during first-run setup.

Whatnot Spy | Resellbot sends Whatnot page URLs and page metadata to Google Analytics.

WhatsApp Web Side Panel - Tabbee removes WhatsApp frame protections when loading web.whatsapp.com.

Whisk 자동화 도구 by 엔라이트랩 includes a recoverable monthly popup password in its shipped JavaScript.

Wild Life sends new-tab searches to a remotely configured search destination.

Woningstats sends viewed Funda listing addresses to api.pdok.nl to resolve property location data.

World Time loads HTML and links from linangdata.com into its popup and opens server-supplied links in new tabs.

WriteMe.ai reads REACT_TOKEN_AUTH tokens from pages and sends them to apiv2.writeme.ai.

Writeseed - Smart AI Assistant writes the same extension user ID into page storage on every HTTP(S) site.

XSLT Tester loads HTML from linangdata.com into its popup on every open and opens server-chosen links in new tabs.

XY HTTP Relay lets any visited page send page-controlled HTTP requests through its background fetch handler.

YIMA sends each visited site's host to ScamAdviser for reputation checks and includes an embedded API key.

YTofMP3 loads Font Awesome CSS from cdnjs.cloudflare.com when its popup opens.

Yay! Another Speed dial! requests saved speed-dial hostnames from img.logo.dev when the new tab page loads.

Yonyx Interactive Decision Tree lets websites send captured fields into its side panel and Yonyx launch URL.

The extension lets any website open an incognito popup to a page-chosen URL.

YouTube Ad Skipper stores ad-skip and hidden-banner counters in YouTube page localStorage.

YouTube Detoxifier sends anonymous click analytics to its Azure-hosted server when timers or settings are used.

YouTube Genius fetches Genius embed code and injects Genius-delivered scripts into YouTube pages.

YouTube Productivity Filter sends YouTube video IDs to Google APIs while checking watch pages.

YouTube Remote lets anyone with the six-letter pairing ID control playback and receive media metadata.

YouTube Transcript Generator loads a remote image from statics.imgkits.com on YouTube watch pages.

Youtube Channels To CSV displays message HTML fetched from its Firebase database inside the extension popup.

Youtube Party opens a Socket.IO connection to redirect.youtubeparty.com on YouTube page loads.

Youtube Video Summary sends YouTube transcripts and video metadata to ChatGPT for automatic summarization.

Zenitsu Agatsuma Live Wallpaper sends saved new-tab shortcut URLs to Google's favicon endpoint.

Zintlr Sales can send full page HTML from pages with LinkedIn-style URL paths to extension.zintlr.com.

Zistemo extension sends a bundled API key with requests to api.zistemo.com.