Low risk browser extensions

Gifs autoplay for Google™ rewrites User-Agent headers on Google Image Search requests to receive animated GIF data from Google's servers.

Gmail Button by cloudHQ enumerates all signed-in Google accounts on Gmail load and sends collected email addresses to cloudhq.net.

Gmail Tabs by cloudHQ collects all signed-in Google account email addresses and transmits them to cloudhq.net on each Gmail load.

Grasp fetches and executes remote interface scripts from prod.shield.grasp.gg inside supported ad-platform pages.

Hack-Tools is a red-team browser toolkit that routes CVE lookups through corsproxy.io and ships hardcoded API keys for RSS feed services.

JustCall injects its content script into any page whose URL merely contains one of ~260 CRM domain names anywhere in the string.

KasWare Wallet exposes the unlocked current wallet address to every visited page through its injected provider.

LINE購物省錢助理 sends every visited page URL to LINE Shopping's GraphQL API to check for partner shopping offers.

Live Chat Overlay sends browser language, timezone, and YouTube video ID to its server on every live chat page load and injects the server's response into the page without sanitization.

Live Screen Recorder sends a persistent anonymous usage identifier to Google Analytics every hour.

NewsGuard sends each visited hostname and hovered link URL to its servers, tied to a persistent per-installation identifier.

OWASP Penetration Testing Kit accepts page bridge messages that send saved DAST scan results to the configured PTK portal.

One-click image downloader - Grabit sends opt-in usage analytics, including domain names, to its vendor backend tied to a persistent device identifier.

ParrotTalks bundles hardcoded Google API credentials in its extension package, exposing vendor-owned keys to any user.

Password Lock for Messenger™ stores the user's lock-screen password as an unsalted SHA-256 hash in local browser storage.

PingOne-Extension injects autofill scripts into all pages and accepts postMessages without origin validation to trigger form fills.

PiratBit - доступ из RUS routes all PiratBit domain traffic through a hardcoded third-party HTTPS proxy at xuyvamebanyerkn.woman-beauty.top.

Polycom RealPresence Web Suite Extension exposes native host messaging and screen capture to any HTTPS page via postMessage bridges.

QLattes loads Font Awesome from use.fontawesome.com when it annotates CNPq Lattes CV pages.

Qwer PDF forwards all postMessage events from any web page to its service worker without validating the sender's origin.

Rakuten Drive contains a flawed postMessage origin check that lets any window inject file links or modify extension settings in Gmail, Slack, and Chatwork.

Rapid Image Search replaces the browser's default search engine with myprivate-search.com and embeds a persistent affiliate tag in every query.

ScreenApp sends the authenticated user's email and display name to PostHog analytics on each popup auth check.

Scroll Capture sends the active tab's page URL to Google Analytics each time the extension toolbar is opened.

Search Engine by SoSearcher sets itself as the default search provider and routes every address-bar query through sosearcher.com with a fixed partner tag.

SheetWA reads your Google account email via the Chrome identity API and sends it to its backend on every startup.

Shoptimate collects product metadata and full page URLs from all websites and transmits them to its servers.

Spector.js injects a global variable and wraps canvas APIs on every page visited, including before the user activates it.

Strava, export gpx track adds a GPX download button to strava.com and redirects users to a donation page on every fifth download.

Stylus (beta) applies user-authored CSS styles to websites and includes hardcoded OAuth client secrets for optional cloud sync providers.

SubTrans sends tab URLs, page titles, and account identifiers alongside subtitle text to its translation and analytics servers.

TRAVIC-Sign runs content scripts on all URLs and allows its local native signing host to direct credentialed HTTP requests to arbitrary URLs.

The World Tab replaces the new tab page and sends search queries to the publisher's own search domain.

Theme & Color Changer for YouTube opens promotional tabs on install and every update without user interaction.

TrustPlugin relays cryptographic signing requests from any web page to a native PKI host without validating the message origin.

Ultra Volume Booster captures tab audio to amplify volume and sends usage telemetry to Google Analytics on startup and hourly.

Userlane transmits visited URLs and user identifiers to its servers and sends session tokens as metadata to a third-party error tracker.

VHelper generates a browser/device fingerprint on Amazon Vine pages and uploads it to api.v-helper.com.

Video Downloader for reddit - Redditsave routes download actions through rapidsave.com with an affiliate referral tag appended to each URL.

The extension posts video brightness measurements from matching iframe pages to their embedding pages.

WABiz Free Bulk Sender (Lite) sends the user's WhatsApp phone number to wabiz.in every five minutes for license validation.

Woodwo New Tab replaces every new tab with an instant redirect to www.woodwo.net.

X (Twitter) Mass Unfollow loads remote GitHub images on X following pages.

XolidoSign relays page messages to a local native crypto-signing component without validating the sender's origin domain.

folkX captures visible profile data from Gmail, X, Instagram, TikTok, WhatsApp, Facebook, and Meet and syncs it to its own CRM backend.

qTest Integration fetches any caller-supplied URL via the extension's broad host permissions, allowing pages to bypass CORS restrictions.

vCaptions transmits the logged-in user's email address to PostHog on startup and login events.

widget.io injects a page-context script into StreamElements overlay pages that accepts postMessage commands from any origin.

The extension sends session cookies to Mail.Ru's advertising platform and transmits daily telemetry with a persistent install ID to Mail.Ru analytics endpoints.

字幕精灵 captures tab audio and streams it to its servers automatically when the extension starts.

Turbo Converter & Custom Web Search replaces the browser's default search engine with Yahoo Search using embedded affiliate tracking parameters.

Worldwide Radio removes Do Not Track and Origin headers from radio stream requests before they are sent.

Sky Follower Bridge routes Bluesky avatar image requests through the developer's proxy server, disclosing which profiles are being compared.

Photo Editor & Search sets the default search engine to a Yahoo affiliate URL that routes search queries through publisher tracking codes.

JavaScript-Java Bridge relays messages between webpages and locally installed Java programs via native messaging, with no validation of which Java host a page may connect to.

YouTube Downloader (UDL Helper) sends browser cookies to a third-party tracking domain before the user accepts any consent prompt.

Task Manager Tab & Custom Web Search sends geolocation data to its servers and redirects searches through a Yahoo affiliate URL.

Video Downloader Pro embeds a hardcoded Twitter API credential that any user of the extension can extract.

NeatDownloadManager Extension forwards detected download links, cookies, and headers to the local NDM app via a loopback WebSocket.