Low risk browser extensions

Foseto reads every visible form field's value, including passwords, and can bundle that into feedback logs shared via Google Drive.

Ali Agent rewrites AliExpress links on every website you visit to route through its own affiliate link.

CG Entry Master sends the user's email, access token, and IP address to its server in cleartext HTTP, embedded in the request URL.

Evisa Extensions hardcodes a full payment card and auto-fills it into Vietcombank's nganluong.vn payment form.

Class Timer sends the active tab's hostname and your typed timer title to its own server whenever you start a timer.

Ali Seller Toolkit rewrites every AliExpress link on every website you visit to earn its own affiliate commission.

InovaDesk's web.whatsapp.com script accepts window messages with no origin check, letting scripts read or replace its stored session token.

Fish Radar sends your location to fishing-report.ru and inserts the server's response into the popup without sanitizing it.

Multi View for Paramount+ strips X-Frame-Options and Content-Security-Policy from every paramountplus.com page, not just its own frames.

Pawaka PDF redirects every PDF tab you open to its own server, sending the full original URL along.

InsumerPass lets any webpage forge a fake wallet connection because its content-script message channel ID is exposed before use.

LeadGen Master reads your WhatsApp phone number and Google account email and sends them to its own server on every WhatsApp Web load.

Session Collector encrypts your saved tab sessions with a key anyone can derive from your email address alone.

VeriSentra accepts login credentials from any local web server on port 3000 or 3002, not just its own site.

Vinova Encryption Plugin bridges every website to a local native host, checking only that messages share the page window, not their origin.

ZapQR relays your password through its own relay.zapqr.ai server as base64 text with no encryption of its own.

Beautiful Roses replaces the New Tab page with a NYTimes Technology RSS feed rendered via unescaped innerHTML.

Deer's new-tab page routes its Amazon shortcut icon through the vendor's own domain instead of amazon.com.

FortiEDR Secure Browser captures the plaintext username and password from every form submitted on every website.

Getaway Simplified falls back to an unauthenticated http://localhost:5999 endpoint whenever its main API call fails.

Hotel Bedding Rating Extension builds a browser fingerprint and sends it with every rating you submit.

Narad.ai streams raw microphone audio to its cloud backend for wake-word detection instead of listening locally.

Similar Feed automatically reads up to 500 recent history items and all bookmarks each day and sends up to 30 of them to a backend.

TravelPins stores your saved locations in a browser cookie on google.com and sends the full list to its own server every week.

Whatfix for Infosys relays unauthenticated postMessage input on Workday pages into an unrestricted background fetch proxy.

Hide Spoilers works with Paramount Plus collects your Paramount+ account, subscription, and viewing activity and sends it to its own server.

Majembu reads your Instagram DM conversations and profile info and sends them to its own server to draft and auto-send AI replies.

RealityCheck sends the page's visible text to Anthropic's API and renders the streamed reply in its popup with unescaped HTML.

Dupay Proxy sends the user's activation token over plain HTTP and receives proxy server credentials back in cleartext.

Dealabs auto-fills and auto-submits coupon codes at checkout using an unsigned, server-supplied configuration for each merchant site.