Low risk browser extensions

EasyLink sends TikTok slider-CAPTCHA data, including your msToken cookie, to a third-party solver service.

AliPrice Search by Image fetches image URLs a web page asks for and uploads them to image-search sites.

AliWangWang Translate sends product titles, prices, images and page URLs from supported shopping sites to index.aiprice.com.

Youtube Timeline sends the video ID of each video you load comments for to an analytics server.

CUSTOM CURSOR reads your Facebook name, ID, emails and phone numbers and sends them to app.mysocial360.com.

Bid Master Controller deletes Copart and IAAI login cookies and closes their tabs when the Bid Master extension is disabled.

Carmover fills shared Copart and IAAI logins fetched from its own backend and logs bids and your IP address.

Drake MeaVana removes framing and Content-Security-Policy headers from responses on every site you visit.

DreamDance adds download and helper features to Jimeng, Dreamina, Poe and Moonvy, and strips security headers on those sites.

Speeder reads Paramount+ profiles, watch list and subscriptions on server command and sends them to me3x.online.

NewTranX sends the first 1000 characters of every page you visit to its own server for language detection, whenever you're signed in.

DossierData BV lets iwize.nl pages drive scraping of Dutch government portals and can forward DigiD login values.

The extension sends your Paramount+ account email, country and ID to its own servers and runs server-issued data-collection commands.

Dictionary to Notion accepts Notion login tokens from any page served on http://localhost:3000, not just its own OAuth flow.

Vinted Scraper - One-Click Data Export broadcasts every API response on Vinted pages to any script sharing the page via postMessage.

IDX Password Manager wraps vault data with one hardcoded AES key, and can autofill credentials into any page from its URL parameters.

PassPass autofills Korean simple-authentication forms and sends feedback text plus the current tab URL to a Telegram bot.

Automatic Tidio Translator sends Tidio chat message text to translation services and takes its page selectors from a vendor server.

Felo's all-sites content script lets any web page make the extension fetch URLs and read back the result.

BNI Philippines sends the URL of non-LinkedIn tabs it can see to mymosttrusted.net along with your profile ID.

Journey ArtPrompt with Midjourney lets a remote server silently replace the new-tab search engine used for every typed query.

Preplarge opens hidden Amazon windows while idle and loads server-supplied affiliate URLs in them.

Livetse adds stock-market tools to tsetmc.com pages and loads ad banners from extension.livetse.ir over plain HTTP.

cashback.pt sends a list of all your installed extensions to its servers every 24 hours.

The New York Times News sources every headline, image, and click-through link from a third-party server, notifiernews.com, not NYT.

MetaGramm replaces the new tab with a grammar editor and search box that send your text to its own servers.

Order 1688 - Taobao adds ordering tools to Taobao, Tmall and 1688 pages and changes two of the site's risk-control flags.

Salvage Copilot sends Copart lot details to its AWS Lambda and fetches extra lots' VINs when the server asks.

YouTube Shorts Remover reads the user's Google activity history and profile data, then sends it to a third-party server.

eCaresConnect injects a content script into every page you visit and opens new windows to URLs built from data read off the page.

Verbal loads its uuid library live from jspm.dev with no version pin, in a worker with tabCapture, scripting and all-site access.

Auto Bidder fetches shared Copart and IAAI logins from its vendor's server and types them into the auction login forms.

Audio to Text for WhatsApp Web sends Business account profile data and phone number to api.kaptionai.com when a remote flag is on.

Fiverr Translator sends your Fiverr chat text to translate-api.ext-api.com over unencrypted HTTP when DeepL is chosen.

GHL Connect sends the full URL of each completed tab load on its meeting-site host permissions to mymosttrusted.net.

AudioZap polls its vendor server every 30 seconds and can be told to upload its stored WhatsApp data.

CRM NaKanikuly Assistant stores your CRM session token and answers page messages with saved tour-operator logins.

Anime Quotes Wallpapers New Tab fetches a remote config on install and startup that can open a server-chosen URL in a new tab.

MetaTSE adds stock-analysis tools to tsetmc pages and checks a license key against boursedan.ir.

Pinterest Downloader adds an image-search button to pages and sends the clicked image URL to api.search-by-image.ru.

Prison Break Wallpapers New Tab fetches a remote file on install that can open a vendor-chosen page in a new tab.

VPN Core sends your public IP address and Google account email and name to rgbcore.ru to authorize proxy access.

Dubai MeaVana removes CSP and X-Frame-Options headers from responses on every site once optional host access is granted.

Visily's screenshot-to-design extension runs on every page and answers any page's request to return a frame's contents.

VideoSeek AI removes the Content-Security-Policy header on TikTok, YouTube, Bilibili, Douyin and Xiaohongshu pages.

YouTube SubStyler reads your Google My Activity watch history, email, gender and birth year hourly and uploads it to metricmuse.xyz.

International Jobs runs a server-controlled DOM scraper across every LinkedIn page it loads on, not just job listings.

Labubu Cursor accepts postMessage commands from any web page and fetches attacker-supplied URLs with the user's credentials.

LinkMatch for Greenhouse pulls LinkedIn profile targets from its server and scrapes them in your logged-in session.

Buy Box 17 sends product details and a persistent ID from retailer pages to a price-comparison server.

Sonic the Hedgehog opens a fake 'browser unsupported' page on install that pushes an Opera GX download through dark patterns.

Whitelabel Record Extension lets any web page start a recording of clicks and typed input in an incognito window.

AutoKling sends usage events with your Kling account email to Google Analytics and may send prompts to its backend.

Bulk message send for Telegram sends the phone number you log in with to the vendor's analytics server.

Keble sends the full page HTML and URL to keble.ai when its autocomplete hits an invalid state.

Whatfix for Sophos - Support shows in-app guides on Salesforce and SendSafely pages, with a page-reachable request relay.

PhoneMondo shows a cloud caller-ID dialog on every page and takes call commands from its vendor server over a WebSocket.

YuJa EqualGround records clicks, typed input and page DOM during user-started flow recording and uploads them to its server.

Sticky Notes overrides the new tab page with a search box that submits typed queries to its own server instead of the browser's default search engine.

Caribbean Stud Poker sends a persistent user ID to its server and renders server-returned HTML in the game popup.