Low risk browser extensions

Notifier for BBC News renders its remote feed into the popup with unescaped HTML, exposing it to markup injection and forced navigation.

BBC Sport renders remote feed content in its popup via unescaped HTML and reports a persistent device ID to its feed server.

CFCA CryptoKit.TRTCW Extension relays native-messaging commands for any page matching one of four bare IP addresses, not a vendor domain.

Wapi IA - Asistente para Mensajes strips WhatsApp Web's Content-Security-Policy header on every icon click and tab switch.

CFCA CryptoKit connects to any native-messaging host that sinotrans.com or y2t.com pages name, with no host allowlist.

Citrix Secure Access (Canary) periodically sends browsing history and device/user telemetry to a Citrix-controlled endpoint.

Click to component listens for window messages with no origin check, letting any page script redirect its next clicked-source URL.

Zevr Guard fetches your public IP from the third-party service api.ipify.org when the side-panel globe is opened.

Vận Chuyển 79 injects a script that overwrites Taobao's anti-fraud flags, disabling its risk detection on every page load.

Sapher Shield sends every website you visit to its own servers for a real-time trust check.

Xuân Trường Logistics defeats Taobao/1688's anti-scraping protections to read prices and bypass risk checks on every page load.

UAR_SKSQUARE_V2P forwards the current page's URL to a local native app whenever the page's DOM contains a specific trigger string.

GH Copilot Master sends your account email and session token to its backend over unencrypted HTTP.

The extension lets any page on broaderway.com.cn tell it which native messaging host to connect to, instead of enforcing one fixed host.

GrabzIt Web Monitor accepts any page's postMessage with no origin check, letting it arm the monitor setup with an attacker-chosen API key.

Smart Office relays messages from any localhost page to its native messaging host without an origin check.

TMDT Việt Trung disables Taobao's own anti-scraping risk flags and OCRs hidden prices off the page.

Everlink overwrites Taobao/1688's own anti-fraud risk flags to false on every page load.

e-signer injects a digital signing and certificate API into local file:// pages and forwards requests to a locally installed native module.

Staking Crypto strips X-Frame-Options and CSP headers from Google, Stripe and hexn.io frames browser-wide, not just its own tab.

CFCA CryptoKit.Paperless.WEGO Extension forwards page-supplied native host names and data to a local smart-card app without validation.

Ziplyne Flex Staging Creator overwrites its stored authentication token with data from unauthenticated postMessage events on any page.

Automatic badoo translator sends chat message text to its own translation backend over plain HTTP instead of HTTPS.

Email Tracker + Tracking Pixel Blocker strips security headers on Outlook and IP-lookup pages for any visitor, not only its own users.

CFCA CryptoKit.NCWR Extension relays messages from any page on localhost or 127.0.0.1 to its installed native application, unfiltered.

CFCA CryptoKit.changecloud Extension bridges its own web pages to a locally installed native application over Chrome's native messaging API.

CFCA CertEnrollment relays native-messaging commands from CFCA's own changecloud domains with no further validation.

Train Complet sends your SNCF booking details, name, email, phone, and card numbers, to traincomplet.fr as unencrypted URL parameters.

WF Tools – CRM Utility sends the user's name, phone number and email to a third-party sales CRM during onboarding.

Hide Yo Links stores your PIN and hidden links in plaintext in local browser storage.

Sentience runs its wallet's plugin sandbox inside its own marketing website instead of MetaMask's isolated execution page.

ZipRecruiter Coupon Finder reports the domain of every website you switch to, not just ZipRecruiter, to cashbackeasy.com.

My Weather Tab sends IP-derived location data to weather services from its new-tab page.

CPR Enroll Agency Connect runs server-supplied automation steps on certification tabs, some via OS-level synthesized clicks.

Ali Agent rewrites AliExpress links on every website you visit to route through its own affiliate link.

CG Entry Master sends the user's email, access token, and IP address to its server in cleartext HTTP, embedded in the request URL.

Evisa Extensions hardcodes a full payment card and auto-fills it into Vietcombank's nganluong.vn payment form.

Class Timer sends the active tab's hostname and your typed timer title to its own server whenever you start a timer.

Ali Seller Toolkit rewrites every AliExpress link on every website you visit to earn its own affiliate commission.

InovaDesk's web.whatsapp.com script accepts window messages with no origin check, letting scripts read or replace its stored session token.

Fish Radar sends your location to fishing-report.ru and inserts the server's response into the popup without sanitizing it.

Multi View for Paramount+ strips X-Frame-Options and Content-Security-Policy from every paramountplus.com page, not just its own frames.

Pawaka PDF redirects every PDF tab you open to its own server, sending the full original URL along.

InsumerPass lets any webpage forge a fake wallet connection because its content-script message channel ID is exposed before use.

LeadGen Master reads your WhatsApp phone number and Google account email and sends them to its own server on every WhatsApp Web load.

Session Collector encrypts your saved tab sessions with a key anyone can derive from your email address alone.

VeriSentra accepts login credentials from any local web server on port 3000 or 3002, not just its own site.

Vinova Encryption Plugin bridges every website to a local native host, checking only that messages share the page window, not their origin.

ZapQR relays your password through its own relay.zapqr.ai server as base64 text with no encryption of its own.

Beautiful Roses replaces the New Tab page with a NYTimes Technology RSS feed rendered via unescaped innerHTML.

Deer's new-tab page routes its Amazon shortcut icon through the vendor's own domain instead of amazon.com.

FortiEDR Secure Browser captures the plaintext username and password from every form submitted on every website.

Getaway Simplified falls back to an unauthenticated http://localhost:5999 endpoint whenever its main API call fails.

Hotel Bedding Rating Extension builds a browser fingerprint and sends it with every rating you submit.

Narad.ai streams raw microphone audio to its cloud backend for wake-word detection instead of listening locally.

Similar Feed automatically reads up to 500 recent history items and all bookmarks each day and sends up to 30 of them to a backend.

TravelPins stores your saved locations in a browser cookie on google.com and sends the full list to its own server every week.

Whatfix for Infosys relays unauthenticated postMessage input on Workday pages into an unrestricted background fetch proxy.

Hide Spoilers works with Paramount Plus collects your Paramount+ account, subscription, and viewing activity and sends it to its own server.

Majembu reads your Instagram DM conversations and profile info and sends them to its own server to draft and auto-send AI replies.