Low risk browser extensions

Streaming Skipper reports your Paramount+ account activity to a third-party server and sends your email address to a second one.

mdistats.online reads your Wildberries seller suppliers' phone numbers and uploads them weekly to its own server.

The senvina.net ordering tool reads product and shop pages you browse on Asian marketplaces and uploads them to its servers.

The extension rewrites Taobao, Tmall, 1688 and Pinduoduo product links on any page to tracked cashback links from its own servers.

Discord Token Login sends the Discord token you type into it to discord.com as a plain, unencoded URL parameter.

Mark replaces Taobao, Tmall and JD product links on every web page with affiliate links from feed.hocgin.com.

CFCA CertEnrollment relays messages from a narrow set of internal addresses to a local PKI app without validating the command.

CFCA CryptoKit relays a caller-named native messaging host and payload to it, with no allowlist check.

The extension rewrites product links on every page and sends marketplace product and shop data to the vendor's servers.

Dogs MeaVana, a new-tab page, removes frame and Content-Security-Policy headers from responses on every site it can access.

AudioBriefs reads WhatsApp Web message data and passes it to a vendor-hosted page for voice-message summaries.

Brave AI runs a content script on every page that answers page messages with the user's stored vendor login ID.

Naruto Wallpapers New Tab fetches a remote JSON file on install and opens a server-chosen URL in a new tab.

Copy Text from Videos sends the page URL and the text you copy via OCR to its own server.

TechnologyChecker sends the hostname of each page you visit to Cloudflare's DNS-over-HTTPS service during technology detection.

ChatGPT to PDF uploads the full conversation HTML, page URL and title to its own backend for each PDF export.

SoundMagic sends the address of every .html, .xml and audio page you open to redcoolmedia.net.

Bridge Collective sends the full URL of each page you visit on its permitted sites to mymosttrusted.net.

Polyhelper sends Polymarket page details and wallet identifiers to its analytics server.

BidPro sends device and location details and Manheim login cookies to auctiongate.io while you browse auction sites.

Grove sends the origin of every http(s) site you visit to api.grove.city to look up tip addresses.

WhatsApp Audio Transcriber sends WhatsApp Web voice-note audio to OpenAI for transcription and translation.

Dragon Ball Super: Broly Wallpapers New Tab fetches a vendor JSON file at install and may open a vendor-chosen URL in a new tab.

Get Link And Peer Review Coursera sends your Coursera user ID and program memberships to letankim.id.vn on key activation.

Powertools redirects your tab to the developer's referral links when you visit Amazon, PayPal, Rakuten and other sites.

17网图搜助手 lets any web page trigger its image search, which uploads a page-chosen image to api.aiprice.com.

GrabzIt Assistant strips security headers and reroutes scripts on grabz.it scrape tabs, and the rules persist after navigation.

OKKI io sends each visited site's hostname and any email addresses found on pages to okki-free.xiaoman.cn.

WAPP Group Sender sends your signup details and usage telemetry to its vendor's cloud endpoints.

Hounds of Business Community sends the URL of each page you finish loading on video-meeting sites to mymosttrusted.net.

Copy Dropdown Lists rewrites clicked outbound links on any page into api.aiprice.com affiliate redirects.

EngagePro sends the URL of each non-LinkedIn page you finish loading to mymosttrusted.net.

Notifier for BBC News renders its remote feed into the popup with unescaped HTML, exposing it to markup injection and forced navigation.

BBC Sport renders remote feed content in its popup via unescaped HTML and reports a persistent device ID to its feed server.

Demon Slayer Wallpapers New Tab fetches a remote config on install and can open a server-chosen URL in a new tab.

TikTok Insights reads TikTok feed, search and profile data and uploads it to kolsprite.com without any user action.

Amazon Coupon Finder sends the full URL of every http(s) page you visit to ext-api.orangeoffer.com.

Zebra Printing lets any web page make the extension send a POST request with a chosen body to any URL, including local network hosts.

AiPrice ERP rewrites links you click on matched shopping sites to go through an aiprice.com redirect URL.

C2C Softphone sends dialed numbers' geolocation lookups to Radar and calls to its own phone API using a hardcoded key.

CFCA CryptoKit.TRTCW Extension relays native-messaging commands for any page matching one of four bare IP addresses, not a vendor domain.

YouTube Video Watch Party sets camera and microphone to allow on every https site at install, skipping per-site prompts.

Wapi IA - Asistente para Mensajes strips WhatsApp Web's Content-Security-Policy header on every icon click and tab switch.

Vnlog.vn order tool rewrites Taobao, Tmall, 1688 and Pinduoduo links on every page to tracked URLs from cashback.gobiz.dev.

WhatSmart CRM connects WhatsApp Web to hiperchat servers that can send messages and read labels through your session.

CFCA CryptoKit connects to any native-messaging host that sinotrans.com or y2t.com pages name, with no host allowlist.

SLTD WA Sender posts your WhatsApp phone, name and email to a vendor CRM endpoint when you first sign up.

AliSave Tools rewrites AliExpress navigations through its affiliate link and sends product IDs to imgvidcfig.com.

EarData runs vendor-directed fetch tasks with your Amazon cookies and sends the full responses back to ear-data.com.

Zenbaia reads text and metadata from every page you visit and loads it into its app.zenbaia.com side panel.

Best Blackjack contacts mines.cloudapi.stream on each start and opens any tab URL the server returns.

The extension scrapes marketplace product and shop pages you browse and uploads them to its operator's servers.

Freedom Trader is a crypto trading wallet that adds a 1-lamport marker transfer to every Solana trade.

GCP Toolkit lets scripts on Lazada-family pages make the extension fetch any URL and return the response text.

My Hero Academia Wallpapers New Tab fetches a remote config and can open a server-chosen tab on install.

Coca Cola MeaVana removes CSP and frame-blocking headers from responses on every site you visit.

AVE VPN shows a 'VPN enabled' toggle but has no proxy or VPN code, and opens a Telegram bot link.

The extension adds a context-menu item that opens the right-clicked link in a Project Plan editor on offidocs.com.

Citrix Secure Access (Canary) periodically sends browsing history and device/user telemetry to a Citrix-controlled endpoint.

Click to component listens for window messages with no origin check, letting any page script redirect its next clicked-source URL.