Low risk browser extensions

Amadeus Wallet lets any web page read the unlocked wallet's public key and lock status without approval.

Amazon Prime Freevee Skipper sends Amazon account details, watch history, and email address to me3x.online and metricsmint.quest.

Adds in-app guidance and automation support for browser-based software.

Belfius Smart Card Reader relays commands from permitted web pages to a native card reader host via native messaging.

Birthday Calendar Exporter for Facebook scans Facebook for friends' birthdays and stores names, IDs, and dates locally.

BitLife Life Simulator Unblocked opens an external publisher page on every install without user interaction.

Bloc de Notas Online is a packaged app that opens an online notepad over cleartext HTTP, so typed notes transit unencrypted.

BookBeam: Extension scrapes Amazon and Audible book metadata on every page visit and transmits it to app.bookbeam.io.

Breeze Search sets breezetask.com as the browser's default search engine, so every address-bar search is sent there.

BrowserTab sends address-bar searches to queryzoom.com after setting it as the default search provider.

CFCA SecEditCtl.SRCB Extension bridges pages on srcb.com and shrcb.com to a locally installed native messaging host without validating the host name supplied by the caller.

Cartoon Yourself sends selected text to cartoonify.de over plain HTTP via a context menu shortcut.

ChatGPT Assistant Plus sends a persistent UUID to Google Analytics hourly and silently opens chatgpt.com tabs to refresh session tokens.

ChatGPT for Gmail by cloudHQ sends the user's Gmail address and email content to cloudHQ servers to power its AI reply features.

Chromium browser automation records user interactions including password field values and replays them by executing caller-supplied scripts in page context.

City Bus Driver Car Game opens a promotional publisher webpage on install and redirects to it on uninstall.

Cloaq requests IP geolocation from ip-api.com over HTTP whenever its popup opens.

Clutter Free prevents duplicate tabs and transmits user IP addresses to geoplugin.net over unencrypted HTTP when the premium page is opened.

Connecteur de sécurité banque à distance bridges BPCE-group banking pages to a local certificate-signing application via native messaging.

Cursorland applies user-selected custom cursors across all visited pages using SVG images fetched from cursor-land.com.

DeleteTweets sends its paid license key over cleartext HTTP and reads your logged-in Twitter/X bearer token to drive bulk tweet deletion.

Efaz's Roblox Verified Badge Add-on injects a cosmetic verified badge into Roblox pages and fetches a developer-controlled list of approved users from cdn.efaz.dev.

Elicit attaches the signed-in user's email address and account tier to log events sent to Datadog.

Exif Viewer loads vendor-supplied HTML and links from linangdata.com into its popup and opens server-chosen links in new tabs.

Faceit EGO Enhancer embeds a clash.gg gambling ad iframe with affiliate tracking on FACEIT room pages.

Font identifier assigns each browser profile a persistent UUID and transmits it with telemetry events to onlineapp.pro.

FoundersCard Chrome Extension fetches a benefit list from founderscard.com and injects server-controlled HTML into every visited web page.

Gifs autoplay for Google™ rewrites User-Agent headers on Google Image Search requests to receive animated GIF data from Google's servers.

Google Images Restored accepts window messages from any page with no origin check, letting an attacker replace the full-size image link.

Grasp fetches and executes remote interface scripts from prod.shield.grasp.gg inside supported ad-platform pages.

Hack-Tools is a red-team browser toolkit that routes CVE lookups through corsproxy.io and ships hardcoded API keys for RSS feed services.

JustCall injects its content script into any page whose URL merely contains one of ~260 CRM domain names anywhere in the string.

KasWare Wallet exposes the unlocked current wallet address to every visited page through its injected provider.

Kendo auto-paginates LinkedIn search results and sends each member's profile details to kendoemailapp.com.

LINE購物省錢助理 sends every visited page URL to LINE Shopping's GraphQL API to check for partner shopping offers.

Leetcode helper by labuladong places the user's labuladong site token into a LeetCode page iframe URL.

Live Chat Overlay sends browser language, timezone, and YouTube video ID to its server on every live chat page load and injects the server's response into the page without sanitization.

Live Screen Recorder sends a persistent anonymous usage identifier to Google Analytics every hour.

Netflix Dual Subtitles sends subtitle text, watch URLs, and page titles to Amplitude analytics on each translation event.

NewsGuard sends each visited hostname and hovered link URL to its servers, tied to a persistent per-installation identifier.

OWASP Penetration Testing Kit accepts page bridge messages that send saved DAST scan results to the configured PTK portal.

One-click image downloader - Grabit sends opt-in usage analytics, including domain names, to its vendor backend tied to a persistent device identifier.

ParrotTalks bundles hardcoded Google API credentials in its extension package, exposing vendor-owned keys to any user.

Password Lock for Messenger™ stores the user's lock-screen password as an unsalted SHA-256 hash in local browser storage.

PingOne-Extension injects autofill scripts into all pages and accepts postMessages without origin validation to trigger form fills.

PiratBit - доступ из RUS routes all PiratBit domain traffic through a hardcoded third-party HTTPS proxy at xuyvamebanyerkn.woman-beauty.top.

Polycom RealPresence Web Suite Extension exposes native host messaging and screen capture to any HTTPS page via postMessage bridges.

Pronounce records microphone audio on any website and streams it to its servers, and sends page domains to Mixpanel.

Qwer PDF forwards all postMessage events from any web page to its service worker without validating the sender's origin.

Rakuten Drive contains a flawed postMessage origin check that lets any window inject file links or modify extension settings in Gmail, Slack, and Chatwork.

Rapid Image Search replaces the browser's default search engine with myprivate-search.com and embeds a persistent affiliate tag in every query.

Replace Google CDN removes security headers from matching CDN responses before pages receive them.

ScratchTools for Scratch sends enabled feature settings to its server and includes them in its uninstall URL.

ScreenApp sends the authenticated user's email and display name to PostHog analytics on each popup auth check.

Scroll Capture sends the active tab's page URL to Google Analytics each time the extension toolbar is opened.

SheetWA reads your Google account email via the Chrome identity API and sends it to its backend on every startup.

Shoptimate collects product metadata and full page URLs from all websites and transmits them to its servers.

Spector.js injects a global variable and wraps canvas APIs on every page visited, including before the user activates it.

Strava, export gpx track adds a GPX download button to strava.com and redirects users to a donation page on every fifth download.