Low risk browser extensions

ViaTrumf Bonusvarsler uses a CloudFront feed to decide where it injects bonus notification markup.

IDL Helper sends a credentialed request to instaloader.net on every page at first run to fetch an attribution value.

YouTube Downloader strips X-Frame-Options and Content-Security-Policy headers from every page you load in Firefox.

Automatic Messenger Translator sends Facebook Messenger message text over plain HTTP when using its DeepL or GPT translation options.

GaiaUpgrade sends avatar image URLs to cors-fix.web.app when exporting saved avatar images.

Taobao Tmall Data Scraper captures and attempts to send the full HTML of every website you visit, not just Taobao or Tmall.

Red Lamborghini Live Wallpaper New Tab renders new-tab content fetched from api.gameograf.com.

The extension rewrites Taobao, Tmall, 1688 and Pinduoduo product links on every page to URLs returned by cashback.gobiz.dev.

Coles Trend sends viewed Coles product metadata and store selection data to its API.

CIVR Connector accepts postMessage from any web page and uses it to auto-fill and submit DICOM viewer login credentials.

DeepDyve Plugin sends saved research search URLs and article-view metadata to DeepDyve by default.

GFC Invoice intercepts clicks on 17 shopping sites and reroutes the purchase through its own affiliate link before it loads.

Etsy Price Tracker reports matching Etsy URLs to Aliprice and can rewrite Etsy links through Aliprice redirects.

AdBlock Ninja reads your precise device location and sends it to its own servers during account signup and social login.

Star Match Game sends popup page-view telemetry with a persistent client ID to Google Analytics.

Multi Login - NapXu.Vn saves TikTok session cookies in plaintext local storage and can export them to an unencrypted file.

Stanford GSB Library Chrome Extension sends a persistent extension user ID and popup activity to Google Analytics.

DS-Backend Web Player removes Content-Security-Policy and X-Frame-Options headers from every http(s) page in all tabs.

VisaJar screenshots your logged-in US visa portal page and uploads it with your appointment details to its servers.

Telfon loads a Microsoft Clarity session recorder in its own softphone pages, uploading interaction recordings to Clarity.

Automatic message translation sends Pro-tier DeepL and AI translation requests over plain HTTP, including message text and the user's session token.

Sidebar for YouTube removes YouTube frame-blocking headers from subframe responses across browsing contexts.

MoiTuristy Helper auto-fills tour-operator site logins from the MoiTuristy CRM into the pages you visit.

Assistant for Instagram adds tools to instagram.com and its page message handler checks the sender origin with a substring match.

RingCentral Phone for erecruit replies to any web page messaging its RingCentral frame with the signed-in user's identity.

Automatic LINE APP Translator sends LINE chat text over plain HTTP to translate-api.ext-api.com when the Pro DeepL engine is selected.

Extended works with Paramount Plus reports your account email and viewing activity to servers unrelated to Paramount every 5 minutes.

CallCloud sends user/event telemetry to Discord webhooks and identifies HubSpot callers in LogRocket.

High or Low Casino Game fetches HTML from its own server at the start of each round and inserts it into the game page.

Pomodoro Technique Timer periodically sends a persistent generated device ID to its license server.

FlashVPN routes browser traffic through vendor proxy servers and supplies proxy credentials to any HTTP auth challenge.

FBA Calculator for Amazon FBA Sellers accepts a login API key from any postMessage sender on Amazon pages, with no origin check.

mpSklad injects seller/brand data from mpstats.io into wildberries.ru and ozon.ru pages without HTML-escaping it.

OCR sends captured screen regions to OCR.space for text recognition and opens a JD Cloud affiliate page from its result link.

Yandex search by image sends the URL, title, and referrer of every page you visit to Google Analytics with a persistent per-install ID.

AliHunter Plus redirects AliExpress product, shop and cart page loads through an affiliate link carrying the vendor's key.

Comics Translator reports the page URL and image URL, with your Google email as ID, to Alibaba Cloud telemetry on each translation.

ETA E-Invoicing Tool - Mohasib Friend sends receipt share URLs to quickchart.io to generate QR codes.

AIChatOne strips X-Frame-Options and CSP headers on ChatGPT, Google, Perplexity, and lmarena.ai on any page load, not just its own chat panel.

Total Privacy For WhatsApp Web loads Google Fonts and Buy Me a Coffee resources when its popup opens.

ezyConneqt reads your LinkedIn session cookies to make authenticated API calls that collect profile data and sends it to ezyHire's servers.

OnlineShoppingTools queries its own coupon database on every site you visit and opens hidden background tabs to insert affiliate cookies when you copy a code.

YAML Validator sends usage telemetry to PostHog despite its store listing claiming your data never leaves your machine.

Sora Video Downloader loads a cdnjs Font Awesome stylesheet on OpenAI and Sora pages.

Watch Together renders other room members' usernames as raw HTML, letting any participant run script in the extension's privileged popup.

Adblock YouTube opens hidden affiliate tabs on ~11,000 partner sites, disguised to users as a tree-planting 'Eco Mode'.

Friend Requests Sender collects Facebook users' email, phone, address, and birthday from imported profiles, undisclosed in its listing.

The extension records media request URLs, page titles and request headers on all sites, and lets web pages open its ffmpeg tool tab.

Wall Smash Game sends popup page-view details and a persistent client ID to Google Analytics when the popup loads.

Angry Birds Side panel MeaVana removes CSP and frame-blocking headers from responses on every site you visit.

League of Legends MeaVana strips frame-blocking and content-security-policy headers from every site the browser visits.

LinkedIn Video Downloader sends the user's signed-in Google account email to an unrelated third-party licensing server.

Cashyo coupon extension lets scripts on retailer pages list and enable or disable installed extensions.

The extension fetches HTML from exad.rangtaobaofei.com and injects it into AliExpress pages as live markup.

Bubble.io Toolkit - Framify.io accepts commands from any web page to install plugins and make authenticated requests in your Bubble app.

WA Sender uploads recipient phone numbers and message text from every WhatsApp send to the vendor's Firebase backend.

Super Megavendas sends user-selected WhatsApp chat transcripts to Google Gemini for AI conversation analysis.

HBO Max SubStyler enables viewing-data sharing by default and sends Max profile and watch data to its servers.

YouTube Comment Navigator injects a script that fetches attacker-chosen URLs with your YouTube cookies on unchecked postMessage requests.

Yay.com Click to Dial places calls from your account when any page clicks a tel: or callto: link.