Low risk browser extensions

BitLife Life Simulator Unblocked opens an external publisher page on every install without user interaction.

Bloc de Notas Online is a packaged app that opens an online notepad over cleartext HTTP, so typed notes transit unencrypted.

BookBeam: Extension scrapes Amazon and Audible book metadata on every page visit and transmits it to app.bookbeam.io.

Breeze Search sets breezetask.com as the browser's default search engine, so every address-bar search is sent there.

CFCA SecEditCtl.SRCB Extension bridges pages on srcb.com and shrcb.com to a locally installed native messaging host without validating the host name supplied by the caller.

Cartoon Yourself sends selected text to cartoonify.de over plain HTTP via a context menu shortcut.

ChatGPT Assistant Plus sends a persistent UUID to Google Analytics hourly and silently opens chatgpt.com tabs to refresh session tokens.

ChatGPT for Gmail by cloudHQ sends the user's Gmail address and email content to cloudHQ servers to power its AI reply features.

Chromium browser automation records user interactions including password field values and replays them by executing caller-supplied scripts in page context.

Cloaq requests IP geolocation from ip-api.com over HTTP whenever its popup opens.

Clutter Free prevents duplicate tabs and transmits user IP addresses to geoplugin.net over unencrypted HTTP when the premium page is opened.

Connecteur de sécurité banque à distance bridges BPCE-group banking pages to a local certificate-signing application via native messaging.

Cursorland applies user-selected custom cursors across all visited pages using SVG images fetched from cursor-land.com.

DraftSharks Sync sends supported fantasy draft room data to DraftSharks for league draft syncing.

EC Assist captures form input values and full page HTML from monitored tabs to validate Google Enhanced Conversions.

Easy Print transmits every search keystroke typed into its new-tab page to easyprintapp.net as autosuggest requests.

Efaz's Roblox Verified Badge Add-on injects a cosmetic verified badge into Roblox pages and fetches a developer-controlled list of approved users from cdn.efaz.dev.

Elicit attaches the signed-in user's email address and account tier to log events sent to Datadog.

Font identifier assigns each browser profile a persistent UUID and transmits it with telemetry events to onlineapp.pro.

FoundersCard Chrome Extension fetches a benefit list from founderscard.com and injects server-controlled HTML into every visited web page.

Free VPN for Chrome - VPN Proxy SandVPN sends visited URLs and referrers to the SandVPN API when Smart Proxy is enabled.

Gifs autoplay for Google™ rewrites User-Agent headers on Google Image Search requests to receive animated GIF data from Google's servers.

Gmail Button by cloudHQ enumerates all signed-in Google accounts on Gmail load and sends collected email addresses to cloudhq.net.

Gmail Tabs by cloudHQ collects all signed-in Google account email addresses and transmits them to cloudhq.net on each Gmail load.

Hack-Tools is a red-team browser toolkit that routes CVE lookups through corsproxy.io and ships hardcoded API keys for RSS feed services.

JustCall injects its content script into any page whose URL merely contains one of ~260 CRM domain names anywhere in the string.

KasWare Wallet exposes the unlocked current wallet address to every visited page through its injected provider.

LINE購物省錢助理 sends every visited page URL to LINE Shopping's GraphQL API to check for partner shopping offers.

Live Chat Overlay sends browser language, timezone, and YouTube video ID to its server on every live chat page load and injects the server's response into the page without sanitization.

Live Screen Recorder sends a persistent anonymous usage identifier to Google Analytics every hour.

NewsGuard sends each visited hostname and hovered link URL to its servers, tied to a persistent per-installation identifier.

One-click image downloader - Grabit sends opt-in usage analytics, including domain names, to its vendor backend tied to a persistent device identifier.

ParrotTalks bundles hardcoded Google API credentials in its extension package, exposing vendor-owned keys to any user.

Password Lock for Messenger™ stores the user's lock-screen password as an unsalted SHA-256 hash in local browser storage.

PingOne-Extension injects autofill scripts into all pages and accepts postMessages without origin validation to trigger form fills.

Polycom RealPresence Web Suite Extension exposes native host messaging and screen capture to any HTTPS page via postMessage bridges.

PubPeer queries its API on each page load and injects comment-link banners into matching academic publication pages.

QLattes loads Font Awesome from use.fontawesome.com when it annotates CNPq Lattes CV pages.

Rakuten Drive contains a flawed postMessage origin check that lets any window inject file links or modify extension settings in Gmail, Slack, and Chatwork.

Rapid Image Search replaces the browser's default search engine with myprivate-search.com and embeds a persistent affiliate tag in every query.

ScreenApp sends the authenticated user's email and display name to PostHog analytics on each popup auth check.

Scroll Capture sends the active tab's page URL to Google Analytics each time the extension toolbar is opened.

SheetWA reads your Google account email via the Chrome identity API and sends it to its backend on every startup.

Shoptimate collects product metadata and full page URLs from all websites and transmits them to its servers.

Spector.js injects a global variable and wraps canvas APIs on every page visited, including before the user activates it.

Speed Auto Clicker accepts parent-frame selection commands in iframes and sends clicked coordinates back.

Strava, export gpx track adds a GPX download button to strava.com and redirects users to a donation page on every fifth download.

Stylus (beta) applies user-authored CSS styles to websites and includes hardcoded OAuth client secrets for optional cloud sync providers.

SubTrans sends tab URLs, page titles, and account identifiers alongside subtitle text to its translation and analytics servers.

TRAVIC-Sign runs content scripts on all URLs and allows its local native signing host to direct credentialed HTTP requests to arbitrary URLs.

The World Tab replaces the new tab page and sends search queries to the publisher's own search domain.

Theme & Color Changer for YouTube opens promotional tabs on install and every update without user interaction.

Userlane transmits visited URLs and user identifiers to its servers and sends session tokens as metadata to a third-party error tracker.

VHelper generates a browser/device fingerprint on Amazon Vine pages and uploads it to api.v-helper.com.

Video Downloader for reddit - Redditsave routes download actions through rapidsave.com with an affiliate referral tag appended to each URL.

The extension posts video brightness measurements from matching iframe pages to their embedding pages.

WABiz Free Bulk Sender (Lite) sends the user's WhatsApp phone number to wabiz.in every five minutes for license validation.

X (Twitter) Mass Unfollow loads remote GitHub images on X following pages.

XolidoSign relays page messages to a local native crypto-signing component without validating the sender's origin domain.

one sec intercepts tab navigation to configured websites and displays a friction screen before the user can continue.