Low risk browser extensions

ChatFlat sends your chat messages and Idealista/Airbnb listing IDs to api.img2html.com under a stored account token.

Connect Castle Solution adds WhatsApp Web customer-service tools and sends voice-note audio to hiperchat.com.br for transcription.

Draw & Highlight on Webpage sends the full URL of the active tab to Google's favicon service.

Evisa Extensions hardcodes a full payment card and auto-fills it into Vietcombank's nganluong.vn payment form.

GetBot sends the page title, URL and page content to api.getbot.ai when you chat with its AI assistant.

MyPicture for Paramount Plus uploads your Paramount+ account email, country, profiles and viewing data to its own servers.

OfferAhead sends your live ChatGPT access token to its own server every time you open the popup.

Olympia Infinity sends your Facebook friends' names, IDs and photo URLs to its own servers for its Messenger CRM.

THPLog copies product-page data from Taobao, Tmall and 1688 and sends it, with your login token, to thplog.com.

Trade Frogs CS2 Assistant checks Steam trade status every minute and reports it to api.tradefrogs.com.

Agência Design Token replaces a site's cookies with session cookies pasted into its popup, then reloads the tab.

Amazon Product Search and Shopping sets chromecrxstore.com as the default search provider, sending address-bar searches there.

Bad URL Killer sends the full URL of every page you navigate to, plus a persistent install ID, to cloudoneth.free.nf.

Class Timer sends the active tab's hostname and your typed timer title to its own server whenever you start a timer.

Crypto Donate Extension loads its settings over plain HTTP and uses the contract address from them as an ERC-20 approval spender.

Darkly redirects your tab to the developer's referral links when you visit Amazon, PayPal, Rakuten and other sites.

Fohlio Web Clipper lets any web page request a PNG screenshot of the visible tab through its content script.

Passwords & Sessions Manager stores its vault's PIN-derived master key alongside the encrypted passwords it protects.

S.Context Gadget blanks the Content-Security-Policy header on every google.com request so it can inject Sateraito iframes.

Sidegame SkySpeedster opens a side panel game that connects to gamewss.cloudapi.stream and displays server-pushed ad content.

Vou Falar sends WhatsApp voice messages you transcribe to the vendor's speech-to-text server.

AI Assistant for WhatsApp sends your WhatsApp number and a Yes/No review answer to a public sheetdb.io spreadsheet.

Ali Seller Toolkit rewrites every AliExpress link on every website you visit to earn its own affiliate commission.

Cart Tracker reads your drugcomparison.co.uk account name and order items and sends them to an Azure backend.

Chat Power adds WhatsApp Web automation and sends voice messages to hiperchat.com.br for transcription when clicked.

ClickDoc VA-2 sends nurse note text from netsmartcloud pages to OpenAI using a hardcoded API key.

Digiskills Quiz Helper sends your name, email, course and quiz questions to a third-party server over plain HTTP.

InovaDesk's web.whatsapp.com script accepts window messages with no origin check, letting scripts read or replace its stored session token.

MetaMan automates Facebook messaging and lets facebook.com pages read its stored vendor login tokens.

MovvaSe adds tools to WhatsApp Web and sends voice messages you transcribe to hc-stt.hiperchat.com.br.

Revolut Proof Provider reads provider-site cookies during Reclaim verification sessions and sends proof data to Reclaim's attestor.

Ruthy's Reach sends the URL of each page you finish loading on its supported meeting sites to mymosttrusted.net.

SoMail sends the recipients, subject and body of every Gmail email you send to its own server.

Trello Task Creator routes your full-access Trello token through a developer-owned webpage instead of Chrome's secure OAuth callback.

Url Shortener for Chrome checks a vendor-hosted message file and shows its contents in the popup.

Advanced Password Manager stores your saved logins, profile details, and PIN in plain text with no encryption.

Botflow adds CRM and automation tools to WhatsApp Web and sends voice messages to its servers for transcription.

Bulk Message Tools sends your WhatsApp phone number, name and Google email to its vendor on first load.

CoCounsel to PDF sends the full rendered chat page to its own cloud backend to build PDF exports.

Deer's new-tab page routes its Amazon shortcut icon through the vendor's own domain instead of amazon.com.

Faire Search by Image lets any web page trigger an image fetch and upload to api.aiprice.com.

Fish Radar sends your location to fishing-report.ru and inserts the server's response into the popup without sanitizing it.

Multi View for Paramount+ strips X-Frame-Options and Content-Security-Policy from every paramountplus.com page, not just its own frames.

Pawaka PDF redirects every PDF tab you open to its own server, sending the full original URL along.

PenX mirrors every open tab's URL, title and favicon, plus all bookmarks, into a local database once signed in.

Permit Place sends the active tab's URL and title to OpenAI to generate prompts, using a hardcoded vendor API key.

Beautiful Roses replaces the New Tab page with a NYTimes Technology RSS feed rendered via unescaped innerHTML.

fare-frenzy reads flight and price details from Kiwi.com booking pages and sends them to core.drct.aero.

AI AliExpress Review Generator randomly rewrites some outbound shopping links to AliPrice affiliate redirects.

Boss Motors extension uploads the HTML of every element you click on Copart, IAAI and Manheim to its own server.

ByteZap sends WhatsApp voice-message audio to hc-stt.hiperchat.com.br for transcription when a user clicks transcribe.

CFCA CertEnrollment.JYBank lets bank-site pages send commands to a local native messaging host.

CFCA CryptoKit relays messages between vendor web pages and a local native application on your computer.

CardVault stores payment cards and lets any *.vercel.app page trigger its automated card-change flow and read visited-site names.

ClickLearn Authoring Tools relays page messages to the ClickLearn desktop app over a local WebSocket.

Grail Connect sends the URL of each finished meeting-site tab load to mymosttrusted.net, tied to the user's profile id.

InsumerPass lets any webpage forge a fake wallet connection because its content-script message channel ID is exposed before use.

LeadGen Master reads your WhatsApp phone number and Google account email and sends them to its own server on every WhatsApp Web load.

News Mango sends your login email and password, and every subsequent API call, over plain HTTP to a bare IP address.

Qwertyware sends the domain of each page you visit to a cashback partner API to look up coupons and deals.