Low risk browser extensions

ClearContext sends the full URL of every page you load to api.clearcontext.co to look up a news bias rating.

GetBot sends the page title, URL and page content to api.getbot.ai when you chat with its AI assistant.

Resist sends the author and text of every X/Twitter post you view to api.resist-extension.org for analysis.

Sunil Edutech for Teacher sends lesson-plan prompts to OpenAI using an API key hardcoded in the extension.

The Global Chamber sends the URL of each completed tab load on its permitted sites to mymosttrusted.net.

UBER BLACK reads Uber session cookies from the active uber.com tab and shows them as a copyable token.

ZipRecruiter Coupon Finder reports the domain of every website you switch to, not just ZipRecruiter, to cashbackeasy.com.

Group Exporter 2 sends the signed-in Chrome profile email to soletstalkapp.com each time the popup opens.

My Weather Tab sends IP-derived location data to weather services from its new-tab page.

Oh Mago CRM adds WhatsApp Web CRM tools and sends voice messages to hc-stt.hiperchat.com.br when you click transcribe.

Portline Auto Import fetches the dealer's Copart password in cleartext and auto-submits it to log them into Copart.com.

Pro Tab replaces the default search provider with protab.info, sending every address-bar search to its servers.

Smart Filters downloads its URL-rewriting rules from smarturlcleaner.com every 30 minutes and installs them on all sites.

TK Video Downloader replays TikTok API requests using URLs and headers dictated by a config from echobot.dev.

The Thrive-O-Sphere sends the URL of each completed tab load on meeting and LinkedIn hosts to mymosttrusted.net.

ZapLead sends WhatsApp voice messages to hc-stt.hiperchat.com.br for transcription when you click 'Transcribe audio'.

CPR Enroll Agency Connect runs server-supplied automation steps on certification tabs, some via OS-level synthesized clicks.

Foseto reads every visible form field's value, including passwords, and can bundle that into feedback logs shared via Google Drive.

RoboZapp uploads the full audio of WhatsApp voice messages to hiperchat.com.br when you use its transcribe button.

The Social Capital Collective sends the URL of meeting pages you open to mymosttrusted.net, tagged with your profile ID.

The Weave Networker sends the URL of each loaded meeting-site tab to mymosttrusted.net along with your profile ID.

Ali Agent rewrites AliExpress links on every website you visit to route through its own affiliate link.

BSCUT sends email text you enter in Gmail to OpenAI to draft replies, using an API key embedded in its code.

CG Entry Master sends the user's email, access token, and IP address to its server in cleartext HTTP, embedded in the request URL.

ChatFlat sends your chat messages and Idealista/Airbnb listing IDs to api.img2html.com under a stored account token.

Draw & Highlight on Webpage sends the full URL of the active tab to Google's favicon service.

Evisa Extensions hardcodes a full payment card and auto-fills it into Vietcombank's nganluong.vn payment form.

MyPicture for Paramount Plus uploads your Paramount+ account email, country, profiles and viewing data to its own servers.

Olympia Infinity sends your Facebook friends' names, IDs and photo URLs to its own servers for its Messenger CRM.

Wallet Highlighter reads emails and crypto wallet addresses on every page and sends them with the page URL to its servers.

Amazon Product Search and Shopping sets chromecrxstore.com as the default search provider, sending address-bar searches there.

Bad URL Killer sends the full URL of every page you navigate to, plus a persistent install ID, to cloudoneth.free.nf.

Class Timer sends the active tab's hostname and your typed timer title to its own server whenever you start a timer.

Crypto Donate Extension loads its settings over plain HTTP and uses the contract address from them as an ERC-20 approval spender.

Darkly redirects your tab to the developer's referral links when you visit Amazon, PayPal, Rakuten and other sites.

Fohlio Web Clipper lets any web page request a PNG screenshot of the visible tab through its content script.

Sidegame SkySpeedster opens a side panel game that connects to gamewss.cloudapi.stream and displays server-pushed ad content.

Vou Falar sends WhatsApp voice messages you transcribe to the vendor's speech-to-text server.

AI Assistant for WhatsApp sends your WhatsApp number and a Yes/No review answer to a public sheetdb.io spreadsheet.

Agência Design Token replaces a site's cookies with session cookies pasted into its popup, then reloads the tab.

Ali Seller Toolkit rewrites every AliExpress link on every website you visit to earn its own affiliate commission.

Cart Tracker reads your drugcomparison.co.uk account name and order items and sends them to an Azure backend.

Chat Power adds WhatsApp Web automation and sends voice messages to hiperchat.com.br for transcription when clicked.

Digiskills Quiz Helper sends your name, email, course and quiz questions to a third-party server over plain HTTP.

InovaDesk's web.whatsapp.com script accepts window messages with no origin check, letting scripts read or replace its stored session token.

MetaMan automates Facebook messaging and lets facebook.com pages read its stored vendor login tokens.

Ruthy's Reach sends the URL of each page you finish loading on its supported meeting sites to mymosttrusted.net.

Timeback-Adapter records fetch and XHR request and response bodies on learning-app sites and sends them to its AWS backend.

Url Shortener for Chrome checks a vendor-hosted message file and shows its contents in the popup.

Botflow adds CRM and automation tools to WhatsApp Web and sends voice messages to its servers for transcription.

Bulk Message Tools sends your WhatsApp phone number, name and Google email to its vendor on first load.

ClickDoc VA-2 sends nurse note text from netsmartcloud pages to OpenAI using a hardcoded API key.

CoCounsel to PDF sends the full rendered chat page to its own cloud backend to build PDF exports.

Faire Search by Image lets any web page trigger an image fetch and upload to api.aiprice.com.

Fish Radar sends your location to fishing-report.ru and inserts the server's response into the popup without sanitizing it.

Multi View for Paramount+ strips X-Frame-Options and Content-Security-Policy from every paramountplus.com page, not just its own frames.

Pawaka PDF redirects every PDF tab you open to its own server, sending the full original URL along.

PenX mirrors every open tab's URL, title and favicon, plus all bookmarks, into a local database once signed in.

Permit Place sends the active tab's URL and title to OpenAI to generate prompts, using a hardcoded vendor API key.

S.Context Gadget blanks the Content-Security-Policy header on every google.com request so it can inject Sateraito iframes.