Low risk browser extensions

Prepod Pro LITE sends test questions and answer options from prepod.nspu.ru to OpenRouter when the AI-solve button is clicked.

RealityCheck sends the page's visible text to Anthropic's API and renders the streamed reply in its popup with unescaped HTML.

TELEFON CONECTA adds CRM and automation tools to WhatsApp Web and sends voice messages to hc-stt.hiperchat.com.br on request.

WImportifyAI lets any webpage ask its content script to fetch a URL of the page's choosing and read back JSON responses.

Whatfix Store 1 relays web-page messages to a background fetch proxy that requests any URL and returns the response.

Dupay Proxy sends the user's activation token over plain HTTP and receives proxy server credentials back in cleartext.

Freechess Chrome lets a local desktop automation app drive the browser, including cookies, page content and scripts, over localhost.

MyResell - BotVinted posts the title, price and photo of each auto-bought Vinted item to a vendor Discord webhook.

Ozon price-comparison tool reports full URL, title and referrer from AI chatbot pages to a Google Analytics property.

Patreon PDF Downloader sends the full HTML of the page you save to its own Cloud Run server to render a PDF.

Reach Webphone fetches SIP login credentials for your email from ari.mobcall.com using a shared password built into the extension.

ARX Tecnologia adds a WhatsApp Web toolbar that sends voice-message audio you transcribe to hc-stt.hiperchat.com.br.

Adblock from Capital One Shopping sends merchant cookie domains and page views on shopping sites to Capital One servers.

D2fac captures Ecuador SRI electronic invoices and uploads them as a ZIP to vmredes.com when the user acts.

Ali Hunter redirects AliExpress product, shop and cart pages through an affiliate link using a key fetched from its server.

AlvoChat adds a CRM overlay to WhatsApp Web and sends the login QR code and session ID to its servers.

The extension tracks Amazon prices and accepts page messages that trigger image uploads to api.aiprice.com.

AmberChat uploads WhatsApp Web login QR codes and deleted or view-once message content to its own backend.

Amolatina multi-account tool sends chat message text and account data from amolatina.com to chatoptimizer.com servers.

AppChat sends deleted and view-once WhatsApp Web message contents to its own servers.

Atenda sends WhatsApp Web message bodies and login QR codes to its own servers for revoked, view-once and Copilot features.

BeChat uploads deleted and view-once WhatsApp Web messages to its own backend, and premium plans forward every message.

Bellara reads shopping carts on https sites and sends them to bellara.shop under a login token stored from page localStorage.

Billy Button records visited URLs and scrapes order history from about 70 retailers for logged-in members.

Boss Motors extension uploads the HTML of every element you click on Copart, IAAI and Manheim to its own server.

CFCA CertEnrollment lets web pages on localhost and ahrcu.com/.net open a named native messaging host and relay JSON to it.

CFCA CertEnrollment lets pages on a few listed IP addresses start a local native-messaging host and relay commands to it.

CFCA CryptoKit.HuNanBank relays messages from Hunan Bank web pages to a local smart-card signing program.

CFCA CryptoKit lets any web page send requests through the extension to a local native messaging host.

The extension relays messages from allowed web pages to a locally installed native signing application.

COUPONS.DE sends the full URL of every https page you open to coupons.comagno.com.

CRMTiger runs inside WhatsApp Web to read chats and messages and send messages for syncing with vTiger CRM.

Baidu Netdisk Save Tool lets pages on baidu.com request a screenshot of your active tab.

Carmover fetches shared Copart/IAAI logins from its backend and reports your auction activity and IP address to it.

Charmlive ChatOS chat optimizer syncs operator account data and Charmdate login details with chatoptimizer.com servers.

ChatLabel sends the WhatsApp Web login QR code and deleted or view-once message bodies to its own servers.

ChatX sends deleted and view-once WhatsApp Web message content to its own backend servers.

Cloudpath Certificate Generator generates certificates on managed ChromeOS and posts the request to the page that triggers it.

Coupert sends the full URL of every page you visit to its servers, plus event telemetry with cookie values.

Coupert sends the full text and attributes of supported checkout pages to its own AI endpoint to locate coupon fields.

Coupert DE sends the full URL of each site you visit to its own API to look up coupons and cashback.

Coupert NL sends the text and attributes of checkout pages to Coupert's servers to find coupon fields.

Curafi sends EHR session cookies and full page HTML from pages you visit to its own servers.

DHD Logistics sends scraped Taobao, Tmall and 1688 product data and your dhdlogs.vn login token to its own API.

Chat Optimizer sends dating.com chat messages and a session token to copilot.theone.ai for AI reply suggestions.

The extension sends dating.com chat and profile data to account.chatoptimizer.com and stores operator logins in page localStorage.

Dealabs auto-fills and auto-submits coupon codes at checkout using an unsigned, server-supplied configuration for each merchant site.

Duis Kurye copies customer order details from delivery-platform pages and sends them to duiskurye.com.tr when its button is clicked.

Earth Maps Satellite sets bestfreemaps.com as the browser's default search provider.

Earth View 360° looks up your city from your IP and sends it to a weather API and its own site.

Expertwig sets expertwig.com as the default search provider, so search queries and suggestions go to its servers.

FindBride ChatOS relays dating-site chat data and account session cookies through account.chatoptimizer.com.

Fiorilli Web Extension lets any web page send commands to a local Fiorilli native client app.

FlowCrm adds a CRM overlay to WhatsApp Web and relays conversation data to its own FlowCrm servers.

Fresh View Search sets itself as the default search engine and sends each omnibox query to freshviewlab.com.

GGSAP relays Taobao, Tmall and 1688 product data to khachhang.ggsap.vn for its ordering service.

Hugopaket adds a courier-dispatch button to restaurant partner panels and sends order details to hugopaket.app.

I9Chat sends the WhatsApp Web login QR code and, on paid plans, deleted messages to its own servers.

InfinityChat reads WhatsApp Web chats and contacts and relays them to its own backend for CRM features.

The extension lets its vendor server read WhatsApp Web chats and messages on demand and sends them to inovstar.com.