Low risk browser extensions

Alby connects to Bitcoin Lightning nodes and sends page metadata, selected text, and account details to its own servers during normal wallet operations.

Allkeyshop writes an affiliate-attribution cookie on eneba.com's checkout page to claim referral commission on the sale.

CFCA CryptoKit accepts a caller-supplied native host name from bank-domain pages and connects to it without validating it against an allowlist.

CXone Agent Noise Cancellation provides audio noise cancellation for NICE CXone contact-center agents and exposes no external data collection.

Caoliao QR Code sends a persistent UUID and userAgent to its vendor analytics endpoint on each user action.

ChinaHelper silently redirects ordinary AliExpress product page visits through an affiliate link carrying the developer's own tracking IDs.

EC Assist captures form input values and full page HTML from monitored tabs to validate Google Enhanced Conversions.

Elfster's Wish It! prefills its wishlist form from a browser message sent by any web page, with no check on who sent it.

Flash AI sends the full URL of nearly every page you visit to its servers to detect product pages.

Free VPN for Chrome - VPN Proxy SandVPN sends visited URLs and referrers to the SandVPN API when Smart Proxy is enabled.

Gather 1.0 Meetings (Classic) sends the signed-in Gather user ID and email-derived profile details to its telemetry endpoint.

The extension accepts unauthenticated postMessage image data and its popup fetches attacker-supplied URLs with the user's cookies attached.

Insert and Send HTML with Gmail transmits a hashed version of the signed-in Gmail address and compose-action events to Google Cloud Pub/Sub.

Lingopie intercepts Netflix and Disney+ subtitle tracks and sends the caption text to its own servers for translation.

Lolli sends the hostname of every site you visit to its own servers to check for a cashback match.

Lucky PDF Converter's new tab page routes its 'coupons' and 'recommended' shortcuts to BeFrugal through a hardcoded affiliate link.

Meditation Search loads a remote S3 page each time you open its new-tab page.

New Tab Studio fetches favicons for your saved shortcuts over plain HTTP, sending each shortcut's hostname in the clear.

Omnimed-QHR authenticator forwards messages from Omnimed web pages to a local smartcard signing app without validating the request.

PixelBlock blocks email tracking pixels in Gmail and registers a permissive Trusted Types 'default' policy that relaxes Gmail's DOM-XSS protections.

PubPeer queries its API on each page load and injects comment-link banners into matching academic publication pages.

Radioplayer UK opens the radioplayer.co.uk listen page in a popup window when you click its toolbar button.

Reading List fetches a favicon from DuckDuckGo for each saved page, disclosing the hostnames of your reading list to a third party.

Reel Downloader for Instagram sends a persistent user ID to a third-party server on startup and captures Instagram session headers.

Relingo runs on every page and sends words and sentences you select to its own API and to third-party dictionary and translation services.

Savvy by Wethrift sends page URLs and titles from visited sites to Google Analytics.

Search Engine by SoSearcher sets itself as the default search provider and routes every address-bar query through sosearcher.com with a fixed partner tag.

The extension bridges Serasa Experian web pages to a local native host (br.experian.com.serasa) for PKI operations including certificate signing and management.

Smart Mute sends extension lifecycle and settings events to Google Analytics using an embedded API secret.

Speed Booster for ChatGPT modifies the ChatGPT page to reduce lag and transmits license keys to Freemius in URL query parameters.

TG DownloadHelper transmits the active tab URL, user email, and a persistent UUID to Alibaba Cloud on install, update, and each download action.

Treatstream reads your delivery address from food-ordering sites like GrubHub and sends it with a session token to treatstream.com.

The extension posts video brightness measurements from matching iframe pages to their embedding pages.

YourTV Chrome extension bridges web pages to a native host using eval() on both incoming and outgoing messages, creating code-execution exposure.

iLovePDF 2 captures a screenshot of the active tab and transmits it as a base64 image to ilovepdf2.com when the user clicks the Screenshot button.

mail.com MailCheck scans open tab URLs at install to capture affiliate codes and sends account and install data to go.mail.com on uninstall.

n8n Chat reads your full n8n workflow JSON and sends it to the AI provider you choose (OpenAI, Anthropic, or Google Gemini).

one sec intercepts tab navigation to configured websites and displays a friction screen before the user can continue.

vCaptions transmits the logged-in user's email address to PostHog on startup and login events.

Шоппер sends product URL, title, price, and brand to shopper.bonbot.ru on every marketplace visit, linked to a per-install UUID.

uBlacklist filters search results on Google and other engines using user-maintained or subscription blocklists.

IBM Aspera Connect relays unvalidated messages from any web page to the locally-installed Aspera native host.

CyberGhost VPN Free Proxy bundles a hardcoded shared API key that is sent to its backend on every request.

YouTube Downloader adds download buttons to YouTube watch pages and fetches YouTube's player JS at runtime to decode video URLs.

Buster bundles Wit.ai API credentials encrypted with a key derived entirely from its own publicly distributed source files.

Repeek sends FACEIT user IDs and Steam IDs to its own servers when viewing match pages on faceit.com.

Turbo Converter & Custom Web Search replaces the browser's default search engine with Yahoo Search using embedded affiliate tracking parameters.

Manuals Hunt and Search overrides the default search engine to Yahoo with undisclosed affiliate tracking parameters on every search.

Shipping Details & Search installs an affiliate-tagged Yahoo search provider and forwards saved tracking numbers to shippingdetails.com.

LetyShops sends account tokens and browsing events to Google Analytics and a GCP endpoint; opt-in on Firefox, opt-out on Chrome.

Flash Player Plus sends a persistent unique user ID and session timing data to flplayer.net on a recurring schedule.

BlockSite sends per-navigation browsing history and a persistent device identifier to its servers when the user enables analytics.

iGraal forwards member ID, a persistent UUID, and merchant URLs to its servers on cashback clicks, and monitors all web requests site-wide.

Map Route Pro and Search relays search queries and inferred location to its servers and replaces your default search engine with Yahoo.

Easy Games Tab routes all user searches through Yahoo affiliate URLs with hardcoded monetization parameters.

2048 Classic Game sends a persistent UUID to Google Analytics every 60 minutes and writes the extension's runtime ID into visited page DOM.

AI Detector - BitMind sends captured image data and page URLs to api.bitmind.ai for AI-generated content detection on every website.

AZInsight sends Amazon visit counts and domain names to api.loopedin.io on every Amazon page load.