Low risk browser extensions

qTest Integration fetches any caller-supplied URL via the extension's broad host permissions, allowing pages to bypass CORS restrictions.

vCaptions transmits the logged-in user's email address to PostHog on startup and login events.

widget.io injects a page-context script into StreamElements overlay pages that accepts postMessage commands from any origin.

The extension sends session cookies to Mail.Ru's advertising platform and transmits daily telemetry with a persistent install ID to Mail.Ru analytics endpoints.

Photo Editor & Search sets the default search engine to a Yahoo affiliate URL that routes search queries through publisher tracking codes.

Turbo Converter & Custom Web Search replaces the browser's default search engine with Yahoo Search using embedded affiliate tracking parameters.

Task Manager Tab & Custom Web Search sends geolocation data to its servers and redirects searches through a Yahoo affiliate URL.

Worldwide Radio removes Do Not Track and Origin headers from radio stream requests before they are sent.

Sky Follower Bridge routes Bluesky avatar image requests through the developer's proxy server, disclosing which profiles are being compared.

iGraal forwards member ID, a persistent UUID, and merchant URLs to its servers on cashback clicks, and monitors all web requests site-wide.

JavaScript-Java Bridge relays messages between webpages and locally installed Java programs via native messaging, with no validation of which Java host a page may connect to.

YouTube Downloader (UDL Helper) sends browser cookies to a third-party tracking domain before the user accepts any consent prompt.

Video Downloader Pro embeds a hardcoded Twitter API credential that any user of the extension can extract.

Flight Tab Pro redirects all address-bar and new-tab searches through Yahoo affiliate URLs that pay the publisher per query.

Rutoken Plugin Adapter bridges every visited page to a native Rutoken hardware token host via a postMessage relay with no origin restriction.

TunnelBear VPN routes browser traffic through a proxy and accepts control messages from any Firefox extension without sender validation.

City Scapes sends every new-tab search query to a third-party monetized search proxy instead of your browser's default search engine.

Beautiful Beaches sends new-tab search queries to a third-party search proxy instead of the browser's default search engine.

Majestic Mountain Views sends every new-tab search query to landscape-extensions.com instead of your default search engine.

NeatDownloadManager Extension forwards detected download links, cookies, and headers to the local NDM app via a loopback WebSocket.

WEB.DE MailCheck for Firefox enables analytics on update and ships hardcoded OAuth client secrets for four mail providers.

CS2 Trader scrapes Steam API keys and access tokens from Steam pages on install and sends item inspection data to its developer backend.

30 Seconds of Knowledge sends page-view telemetry from its new tab and UI pages to Google Analytics with persistent IDs.

ATLANTIS 3D Editor Launcher forwards messages from vendor web pages to a native host without input validation.

Ad Blocker Chrome extension sends install and update telemetry with a persistent user ID and browser/system fingerprint.

AdBlock Detector Bypass by CPE lets any webpage save hidden-element rules that later hide matching content on chosen sites.

Adobe Experience Cloud Visual Editing Helper lets the first authoring message origin control page DOM edits.

AiPrice(AliPrice) Search by image for AE accepts page messages that can open attacker-chosen tabs or windows.

Amazing Screen Recorder sends a persistent pseudonymous UUID to Google Analytics on every startup and once per hour.

Amazon Dark Mode loads its popup stylesheet from jsDelivr when the extension UI opens.

AppSheet Toolbox removes framing protections from Google AppSheet support pages so it can display them in its drawer.

Atlan exposes its install/configuration status and saved language to any website through its external message API.

Augnito captures microphone audio and streams it to the Augnito speech backend, then writes the returned transcription into the active page's text field.

Birthday Calendar Exporter for Facebook scans Facebook for friends' birthdays and stores names, IDs, and dates locally.

BitsLab Safe sends every visited URL and a persistent device identifier to its own servers, and transmits wallet and transaction details to Mixpanel.

Bloomberg Terminal: Clip to NOTE lets any web page submit supplied files and notes to Bloomberg ClipServ.

BrowserTab sends address-bar searches to queryzoom.com after setting it as the default search provider.

Bulk Image Downloader From Url List can write your stored account email and license status into matching webpages.

CFCA CryptoKit.SRCBSCF Extension bridges CFCA-affiliated banking pages to a local native messaging host for cryptographic operations.

CFCA WebSeal.SRCB Extension bridges bank web pages to local native security software via native messaging, accepting the target host name from the calling page without validation.

ChatGPT Optimizer sends user-selected page text to ChatGPT and user-entered URLs to productivity.rocks.

ChatGPT for Gmail sends your Gmail account email, timezone, and selected draft text to Salesgear AI endpoints.

Chatwork Quick Info Input injects Google Fonts into ChatWork pages, sending referrer and IP metadata to Google.

City Bus Driver Car Game opens a promotional publisher webpage on install and redirects to it on uninstall.

Claude Fable 5 Limit & Usage Tracker - ClaudeKarma sends daily health counters, version, OS, and language to TokenKarma.

Claude QoL lets scripts on Claude pages read its stored text-to-speech provider API key through a postMessage settings bridge.

Colorway is a color-picker that, once opened on a tab, accepts page messages with no origin check to capture a screenshot or write its storage.

Conductor for Chrome reports every page URL you visit to its background worker and sends on-page SEO scrapes to Conductor for signed-in users.

Convert HEIC to JPG injects a hidden onlineapp.pro paywall iframe into every page and runs a leftover dev hot-reload client on localhost.

Country Flags & IP Whois loads a GeoLite2 database from a CDN without integrity checks to resolve page IP addresses to countries.

Crunchbase sends LinkedIn parser errors, including page DOM snippets and URL context, to Sentry.

Delete Facebook™ Posts, Photos, etc. loads remote SocialErase news HTML into its popup.

DeleteTweets sends its paid license key over cleartext HTTP and reads your logged-in Twitter/X bearer token to drive bulk tweet deletion.

Demandware With Ease sends encoded Salesforce Commerce Cloud account fields to Google Analytics on each Demandware instance visit.

Dino 3D inserts a quick-access button into webpages that exposes its extension ID in page-visible DOM IDs.

Discord Chat Export Tool copies your Discord authorization token into a page-readable body attribute on discord.com.

Dmooji - YouTube Danmaku reports YouTube live chat visits with persistent identifiers to Dmooji.

Doge Labs Wallet lets any top-level website request your wallet public key, balance, and inscriptions without connection approval.

Download Blocker intercepts browser downloads and blocks HTML smuggling attacks based on enterprise-configurable file inspection rules.

Dragon Medical Web Extension accepts postMessage without origin checks on all pages, allowing any site to inject text into active editors.