Low risk browser extensions

SoMail sends the recipients, subject and body of every Gmail email you send to its own server.

fare-frenzy reads flight and price details from Kiwi.com booking pages and sends them to core.drct.aero.

AI AliExpress Review Generator randomly rewrites some outbound shopping links to AliPrice affiliate redirects.

ByteZap sends WhatsApp voice-message audio to hc-stt.hiperchat.com.br for transcription when a user clicks transcribe.

CFCA CertEnrollment.JYBank lets bank-site pages send commands to a local native messaging host.

CFCA CryptoKit relays messages between vendor web pages and a local native application on your computer.

ClickLearn Authoring Tools relays page messages to the ClickLearn desktop app over a local WebSocket.

Grail Connect sends the URL of each finished meeting-site tab load to mymosttrusted.net, tied to the user's profile id.

InsumerPass lets any webpage forge a fake wallet connection because its content-script message channel ID is exposed before use.

LeadGen Master reads your WhatsApp phone number and Google account email and sends them to its own server on every WhatsApp Web load.

Qwertyware sends the domain of each page you visit to a cashback partner API to look up coupons and deals.

Session Collector encrypts your saved tab sessions with a key anyone can derive from your email address alone.

Shop a Tree sends the full URL of every https page you visit to shopatree.de.

Trade Frogs CS2 Assistant checks Steam trade status every minute and reports it to api.tradefrogs.com.

Tuebora Quick Sign in fills stored single sign-on credentials into any page whose URL carries login=extn and an assetRef.

VEXA INOVAÇÃO sends WhatsApp Web voice-note audio to third-party servers for transcription and conversion.

VeriSentra accepts login credentials from any local web server on port 3000 or 3002, not just its own site.

Vinova Encryption Plugin bridges every website to a local native host, checking only that messages share the page window, not their origin.

ZapQR relays your password through its own relay.zapqr.ai server as base64 text with no encryption of its own.

Beautiful Roses replaces the New Tab page with a NYTimes Technology RSS feed rendered via unescaped innerHTML.

performancemais sends WhatsApp voice messages to its own transcription server when you click transcribe.

sslspeedy runs JavaScript from 678in.com in its popup and routes non-.cn traffic through a proxy that server picks.

Ân Gia Logistics copies Taobao, Tmall and 1688 product details and sends them to its own cart API.

BonBon lets any web page trigger requests to its vendor's crm.ecom-science.com backend and to TikTok seller tabs.

CFCA CryptoKit relays messages from DBS bank web pages to a local CFCA native messaging host.

Canto-HubSpot Connector sends its installed version to its vendor's server and shows server-supplied update notices on HubSpot pages.

CardVault stores payment cards and lets any *.vercel.app page trigger its automated card-change flow and read visited-site names.

DC Tracker reads product, price and supplier data from drugcomparison.co.uk and uploads it to an Azure backend.

Deer's new-tab page routes its Amazon shortcut icon through the vendor's own domain instead of amazon.com.

FortiEDR Secure Browser captures the plaintext username and password from every form submitted on every website.

Getaway Simplified falls back to an unauthenticated http://localhost:5999 endpoint whenever its main API call fails.

HEIAN Wallet stores the unlocked private key and mnemonic in plaintext extension storage and exposes the wallet address to any page.

Hotel Bedding Rating Extension builds a browser fingerprint and sends it with every rating you submit.

Kiblat sends your GPS coordinates to a developer-hosted GitHub Pages map embedded in its popup.

Narad.ai streams raw microphone audio to its cloud backend for wake-word detection instead of listening locally.

Prepod Pro sends quiz questions and answer options from prepod.nspu.ru to openrouter.ai when the AI-answer button is clicked.

Revolut Proof Provider reads provider-site cookies during Reclaim verification sessions and sends proof data to Reclaim's attestor.

Royal Motors fills shared Copart and IAAI logins fetched from its server and reports lots viewed and bids placed.

Rutgers University MeaVana removes CSP and frame headers from all pages once the user grants broad site access.

Secure access to Discord sends each page URL you visit, about once a day, to www.winfy.net.

SellersTracker sends a per-install ID and a stored-seller count to the vendor's Airtable base once a day.

Similar Feed automatically reads up to 500 recent history items and all bookmarks each day and sends up to 30 of them to a backend.

THPLog copies product-page data from Taobao, Tmall and 1688 and sends it, with your login token, to thplog.com.

TravelPins stores your saved locations in a browser cookie on google.com and sends the full list to its own server every week.

USAuction receives shared Copart and IAAI account logins from its server and signs in with a spoofed Kyiv location.

Whatfix for Infosys relays unauthenticated postMessage input on Workday pages into an unrestricted background fetch proxy.

iWize lets iwize.nl pages drive logged-in Dutch government portals and collect documents and data from them.

AdShield for YouTube blocks YouTube ads and, if opted in, fetches server-chosen URLs and uploads the ad pages it finds to adpocalypse.net.

BYS Convert uploads WhatsApp Web voice messages to hc-stt.hiperchat.com.br for transcription.

BoostMyPosts reads LinkedIn and X session cookies and auth headers and sends them to api-podawaa.com.

Carload fetches shared Copart and IAAI login credentials from its backend and fills them into auction login pages.

DiscountDB Coupons sends the hostname of every page you finish loading to api.simplycodes.com.

Easy and Precise Cleaner sends a persistent user ID and its enabled cleaning rules to its own server once a day.

Gana Digital adds a WhatsApp Web tool that sends voice-message audio to a Hiperchat transcription server.

HGTX Intelligence Starter adds WhatsApp Web tools and connects to Hiperchat servers with your WhatsApp ID on every load.

Hide Spoilers works with Paramount Plus collects your Paramount+ account, subscription, and viewing activity and sends it to its own server.

Majembu reads your Instagram DM conversations and profile info and sends them to its own server to draft and auto-send AI replies.

Micode WebPhone lets any web page trigger outbound VoIP calls from the user's logged-in softphone account.

Newtabtvds replaces the default search provider with search.newtabtv.com over plain HTTP.

Preplarge sends your Amazon Seller Central inventory report to app.preporder.com every 3 hours.