Low risk browser extensions

Deep Fishing is a game popup that displays ads pushed from a remote WebSocket server.

MyFootballTab sends your approximate location to weatherapi.com and routes new-tab searches through myfootballtab.com.

Taste captures a screenshot of the visible tab on sites showing a cookie banner and uploads it to taste-api.taaste.io.

Referral Machine Connect sends the URL of each page you finish loading on its supported sites to mymosttrusted.net.

Royal Motorts fetches shared Copart/IAAI buyer logins from its backend and logs your bids and lot visits.

Socialscope reads your TikTok account info and ads session headers and sends them to its own backend.

Evolvepreneur sends the URL of each loaded meeting tab to mymosttrusted.net.

Link to Panel by NNT removes framing and CSP headers from responses on every site you visit.

BiteFight Auto Adventure sends your game profile and bot settings to extensions.tote.hu.

Buy Local Sunshine Coast sends the full URL of meeting-site tabs you open to mymosttrusted.net.

ChatTAB sends your OpenAI API key, org ID and recent chat messages to a third-party server in URL parameters.

Save Story for Instagram downloads files from any URL that a web page posts to it, with no origin check.

Snakes & Ladders loads a server-controlled ad image and link from multiaccount.cloudapi.stream during play.

Grok to PDF uploads the full Grok conversation HTML to its own cloud backend on every PDF export.

Run-n-Drive routes Copart and IAAI traffic through vendor proxies and fills auction logins with shared credentials.

Cluing registers the URL and title of each page you visit and uploads per-paragraph reading activity to its servers.

IndiaMART Lead Extractor sends scraped buyer leads and login details to master-admin-extension.yiion.com over plain HTTP.

ChatGPT Ad Blocker runs a content script on every website and applies hide/remove rules fetched from its own server every 6 hours.

GroupMe Translator sends message text and a session token over unencrypted HTTP to its translation server.

IntelBee detects website technologies and sends visited hostnames and page metadata to dong.intelbee.com by default.

Slinko redirects pages on shopping and rewards sites to the vendor's own referral links, at most once per 24 hours per site.

Tabblar redirects visits to 14 brand sites to the developer's referral links, once per 24 hours per site.

Trinka AI for Firefox sends the full URL of every page you load to Amplitude and relays page messages into background requests.

Where Sneakers checks each site you open against affiliate partners and replaces existing affiliate cookies with its own link.

Everlink overwrites Taobao/1688's own anti-fraud risk flags to false on every page load.

Walmart Coupon Finder sends the full URL of every http/https page you visit to ext-api.orangeoffer.com.

Quiz Boost AI reads the quiz page's HTML and images and sends them to its own server to generate answers.

Soreli fetches shared Copart and IAAI login passwords from sorex.ge and fills them into auction login forms.

Noob Wallet is a multi-chain crypto wallet whose referral feature accepts page-supplied codes on supported trading sites.

Ziplyne Demo Creator sends page URLs and titles to demoapi.ziplyne.com, encrypted with a passphrase shipped in the extension.

e-signer injects a digital signing and certificate API into local file:// pages and forwards requests to a locally installed native module.

Alibaba Cashback opens an Alibaba affiliate link in a new tab on browser startup and on new tabs, at most once per day.

Auction Doors sends Copart and IAAI bid events, with IP and location, to api.auctiondoors.com.

EpicChatGPT sends your OpenAI account details and ChatGPT image metadata to api.epicchatgpt.com.

ExpertEase.NETWORK sends the URL of each page you open on its supported meeting sites to mymosttrusted.net.

INWISE CRM adds CRM tools to WhatsApp Web and can run commands issued by a Hiperchat server.

Lync lets any web page replace its stored login token and clear cookies for a backend-chosen site.

Staking Crypto strips X-Frame-Options and CSP headers from Google, Stripe and hexn.io frames browser-wide, not just its own tab.

cashyo.com sends your full list of installed extensions to api.cashyo.com once a day.

CFCA CryptoKit.Paperless.WEGO Extension forwards page-supplied native host names and data to a local smart-card app without validation.

Dark Side applies dark mode to pages and fetches cross-origin stylesheets on the page's behalf through its background worker.

Royal Motors Controller tracks Copart and IAAI tabs and clears their session cookies when the extension is disabled.

SHEIN Price Tracker lets any web page trigger image fetches that are uploaded to api.aiprice.com.

Shein image downloader uploads product details from three Korean shopping sites to AiPrice servers automatically.

Ziplyne Flex Staging Creator overwrites its stored authentication token with data from unauthenticated postMessage events on any page.

Automatic badoo translator sends chat message text to its own translation backend over plain HTTP instead of HTTPS.

Cargo Express fetches shared Copart and IAAI buyer passwords from its backend and logs users into auction sites without showing them.

Email Tracker + Tracking Pixel Blocker strips security headers on Outlook and IP-lookup pages for any visitor, not only its own users.

Interactive Reader sends selected page text to a bare IP over plain HTTP for translation.

US Visa Appointment Rescheduler sends your visa-portal email, applicant name and booking details to usvisaserver.zapto.org.

CFCA CryptoKit.NCWR Extension relays messages from any page on localhost or 127.0.0.1 to its installed native application, unfiltered.

CFCA CryptoKit.changecloud Extension bridges its own web pages to a locally installed native application over Chrome's native messaging API.

Dymo sends the URL of each page you visit to api.tpeoficial.com when its security checks and an API key are set.

Elevated Expert Collective sends the full URL of meeting-site tabs to mymosttrusted.net along with your profile ID.

GLB.GE Login auto-fills a hardcoded shared edgepipeline.com login and sends dealer activity logs to demoadmin.glb.ge.

WB Seller automatically uploads 30 days of your Wildberries seller analytics to plag.mpsysteam.ru.

WHATZIP adds a transcribe button to WhatsApp Web that sends the clicked voice message to hc-stt.hiperchat.com.br.

Timezone replaces the new tab page with a search box that sends typed queries to query-fuel.com.

miniOrange Secure Single Sign-On fills saved logins into web forms using credentials fetched from a configurable miniOrange SSO server.

CFCA CertEnrollment relays native-messaging commands from CFCA's own changecloud domains with no further validation.