Low risk browser extensions

CFCA CryptoKit.Paperless.WEGO Extension forwards page-supplied native host names and data to a local smart-card app without validation.

Royal Motors Controller tracks Copart and IAAI tabs and clears their session cookies when the extension is disabled.

SHEIN Price Tracker lets any web page trigger image fetches that are uploaded to api.aiprice.com.

Shein image downloader uploads product details from three Korean shopping sites to AiPrice servers automatically.

Ziplyne Flex Staging Creator overwrites its stored authentication token with data from unauthenticated postMessage events on any page.

Automatic badoo translator sends chat message text to its own translation backend over plain HTTP instead of HTTPS.

Azentio PANINI Control relays scan requests from any webpage to a native document-scanner program, with no check on which site sent them.

Cargo Express fetches shared Copart and IAAI buyer passwords from its backend and logs users into auction sites without showing them.

Dark Side applies dark mode to pages and fetches cross-origin stylesheets on the page's behalf through its background worker.

Email Tracker + Tracking Pixel Blocker strips security headers on Outlook and IP-lookup pages for any visitor, not only its own users.

Interactive Reader sends selected page text to a bare IP over plain HTTP for translation.

Lync lets any web page replace its stored login token and clear cookies for a backend-chosen site.

US Visa Appointment Rescheduler sends your visa-portal email, applicant name and booking details to usvisaserver.zapto.org.

ARCON Browser Extension lets any web page trigger its proxy, login and SAML automation through an unchecked postMessage relay.

CFCA CryptoKit.NCWR Extension relays messages from any page on localhost or 127.0.0.1 to its installed native application, unfiltered.

CFCA CryptoKit.changecloud Extension bridges its own web pages to a locally installed native application over Chrome's native messaging API.

Elevated Expert Collective sends the full URL of meeting-site tabs to mymosttrusted.net along with your profile ID.

Emitrr dev sends full page HTML to a third-party AWS endpoint when its contact scanner can't match a name, on any site you visit.

Copilot to PDF uploads the full rendered conversation HTML, page URL and title to its Cloud Run backend on each PDF export.

WHATZIP adds a transcribe button to WhatsApp Web that sends the clicked voice message to hc-stt.hiperchat.com.br.

Better Tab redirects AliExpress and other shop navigations through its affiliate links, replacing other publishers' tags.

Timezone replaces the new tab page with a search box that sends typed queries to query-fuel.com.

AR Wp Detector reads your signed-in Chrome profile email and sends it to api.wpoptic.com on startup.

CFCA CertEnrollment relays native-messaging commands from CFCA's own changecloud domains with no further validation.

Cars From USA logs Copart and IAAI lot activity and bids to its backend and signs users into shared auction accounts.

The Operators Trusted Network sends the URL of each page you finish loading on its permitted sites to its own server.

UrlTool sends the active tab's URL to ksurl.cn when you click its short-link button.

emPartner sends the URL of each page you load on its permitted meeting sites to mymosttrusted.net.

Best Snake fetches HTML from its own server on each popup open and renders it unsanitized in the popup.

AI Chess Tutor loads HTML from linangdata.com into its popup and opens server-chosen links in new tabs.

Auto Market fetches shared Copart/IAAI login credentials from its backend and fills them into auction login forms.

AutoVidu automates prompt sending on Vidu and posts prompts, your email and ID to its own backend for sampled moderation checks.

Shielded sends full email content to its own backend and OpenAI, protected only by a bearer token shared by every install worldwide.

The Maverick Connect sends the URL of meeting pages you load to mymosttrusted.net.

Elite Leadership Network sends the URL of meeting tabs you open to mymosttrusted.net along with your profile ID.

Spotify Web Player Search sets chromecrxstore.com as the default search engine, which its listing does not mention.

Train Complet sends your SNCF booking details, name, email, phone, and card numbers, to traincomplet.fr as unencrypted URL parameters.

MeaVana removes X-Frame-Options and Content-Security-Policy headers from responses on all sites once host access is granted.

SimplyBestCoupons fetches its affiliate and merchant config over plaintext HTTP from cdn.simplybestcoupons.com.

Logiline | synchronizer relays auction purchase data from car-auction sites to its CRM backend.

Spending Calculator for Amazon reads your Amazon order history and account contact details and sends them to ecombullet.com.

FLEXZAP adds WhatsApp Web tools and sends voice messages you transcribe to hc-stt.hiperchat.com.br.

Magic Extension accepts commands from any page on localhost or bettir.com to inject HTML into your open tabs.

Recherche Yahoo par PDF Easy Convert sets craftup.net as the default search engine under the name Yahoo.

Aliexpress Coupon Finder sends the full URL of every page you visit to ext-api.orangeoffer.com.

Azentio Signature Verification Control relays window messages from any web page to a local native host app.

Integração CRM com WhatsApp reads active WhatsApp Web chats and syncs contacts and messages to the user's chosen CRM.

REAL BOOSTER - YouTube fetches missions from irank.kr and drives a YouTube tab to search, watch, like and subscribe.

SpeedNetworkingLive sends the URL of meeting pages you open to mymosttrusted.net on every tab load.

mpstars sends the product page SKU to plugin.mpstars.art and inserts the returned fields into Wildberries and Ozon pages.

AliSave redirects AliExpress product pages through an affiliate link whose key it fetches from a Google Sheet.

CG No Login Master runs its popup script on every website visited, sending the page's origin and the user's IP to its vendor's server.

EdPro Circle sends the URL of every non-LinkedIn page you finish loading to mymosttrusted.net.

Focustra Browser Tracker sends the URL, title and active time of every tab to a local desktop app over WebSocket.

MyAdFilter sends the full URL of pages on vendor-listed sites, with ad counts, to api.poc.myadfilter.com.

Redfin Zillow Realtor Superchaged sends listing addresses and visited page URLs to its own API and Google Analytics.

Shopify Spy Pro sends your Chrome profile email and each detected Shopify store's URL to thinksolv.com.

WF Tools – CRM Utility sends the user's name, phone number and email to a third-party sales CRM during onboarding.

WLEMMatchMaker sends the URL of each page you finish loading to mymosttrusted.net.

Zap Vende sends WhatsApp IDs and chat IDs to hiperchat.com.br servers when its transfer or API-events features are enabled.