Low risk browser extensions

Research Assistant - Auto Citation Tool renders saved highlights via innerHTML, letting page text run script inside its popup.

Session Collector encrypts your saved tab sessions with a key anyone can derive from your email address alone.

Shop a Tree sends the full URL of every https page you visit to shopatree.de.

Tuebora Quick Sign in fills stored single sign-on credentials into any page whose URL carries login=extn and an assetRef.

VEXA INOVAÇÃO sends WhatsApp Web voice-note audio to third-party servers for transcription and conversion.

VeriSentra accepts login credentials from any local web server on port 3000 or 3002, not just its own site.

Vinova Encryption Plugin bridges every website to a local native host, checking only that messages share the page window, not their origin.

ZapQR relays your password through its own relay.zapqr.ai server as base64 text with no encryption of its own.

Ziplyne POC Creator encrypts its API traffic with a passphrase hardcoded in the extension, so the encryption protects nothing.

performancemais sends WhatsApp voice messages to its own transcription server when you click transcribe.

sslspeedy runs JavaScript from 678in.com in its popup and routes non-.cn traffic through a proxy that server picks.

Ân Gia Logistics copies Taobao, Tmall and 1688 product details and sends them to its own cart API.

+rep ID lets anyone forge a "cryptographically signed" reputation tag on its public backend without checking any signature.

Apollo Tab sends new-tab searches to its own server tagged with a persistent per-install ID instead of your default search engine.

Selected Text Magnifier inserts your text selection into its overlay via unescaped innerHTML, letting selected HTML execute on the page.

Business Tools CRM reads your WhatsApp Web phone number and sends it with usage events to an Alibaba Cloud log service.

Canto-HubSpot Connector sends its installed version to its vendor's server and shows server-supplied update notices on HubSpot pages.

DC Tracker reads product, price and supplier data from drugcomparison.co.uk and uploads it to an Azure backend.

FortiEDR Secure Browser captures the plaintext username and password from every form submitted on every website.

Getaway Simplified falls back to an unauthenticated http://localhost:5999 endpoint whenever its main API call fails.

HEIAN Wallet stores the unlocked private key and mnemonic in plaintext extension storage and exposes the wallet address to any page.

Hotel Bedding Rating Extension builds a browser fingerprint and sends it with every rating you submit.

Kiblat sends your GPS coordinates to a developer-hosted GitHub Pages map embedded in its popup.

LeadMagnet Plus sends your WhatsApp number, profile name and Chrome email to wa-web-plus.web.app when WhatsApp Web loads.

Leadskatcher lets any website embed WhatsApp Web and read groups, chats and contacts or send messages.

Moneybelfort sends your WhatsApp number and Chrome profile email to aws-api-fp.averion.in on each WhatsApp Web load.

Narad.ai streams raw microphone audio to its cloud backend for wake-word detection instead of listening locally.

POUPE TEMPO SIMPLES ZAP loads a fingerprinting script from openfpcdn.io into WhatsApp Web pages.

Prepod Pro sends quiz questions and answer options from prepod.nspu.ru to openrouter.ai when the AI-answer button is clicked.

Royal Motors fills shared Copart and IAAI logins fetched from its server and reports lots viewed and bids placed.

Rutgers University MeaVana removes CSP and frame headers from all pages once the user grants broad site access.

Secure access to Discord sends each page URL you visit, about once a day, to www.winfy.net.

SellersTracker sends a per-install ID and a stored-seller count to the vendor's Airtable base once a day.

TravelPins stores your saved locations in a browser cookie on google.com and sends the full list to its own server every week.

USAuction receives shared Copart and IAAI account logins from its server and signs in with a spoofed Kyiv location.

WealthPipe sends the full URL of every site you visit or switch to to its own server, with no opt-in.

WebAssistant4 lets any web page communicate with its native desktop app, with no check on who is asking.

Whatfix for Infosys relays unauthenticated postMessage input on Workday pages into an unrestricted background fetch proxy.

Whatfix for Testing accepts postMessage with no origin check on several sites and fetches attacker-supplied URLs, returning the response.

Wolf Bot Ai Sonar Agent lets any web page that frames WhatsApp Web read groups and contacts and send messages.

Ziplyne POC Player encrypts its API traffic with a passphrase hardcoded in every install.

iWize lets iwize.nl pages drive logged-in Dutch government portals and collect documents and data from them.

AdShield for YouTube blocks YouTube ads and, if opted in, fetches server-chosen URLs and uploads the ad pages it finds to adpocalypse.net.

BYS Convert uploads WhatsApp Web voice messages to hc-stt.hiperchat.com.br for transcription.

BonBon lets any web page trigger requests to its vendor's crm.ecom-science.com backend and to TikTok seller tabs.

BoostMyPosts reads LinkedIn and X session cookies and auth headers and sends them to api-podawaa.com.

Carload fetches shared Copart and IAAI login credentials from its backend and fills them into auction login pages.

DiscountDB Coupons sends the hostname of every page you finish loading to api.simplycodes.com.

Easy and Precise Cleaner sends a persistent user ID and its enabled cleaning rules to its own server once a day.

Gana Digital adds a WhatsApp Web tool that sends voice-message audio to a Hiperchat transcription server.

HGTX Intelligence Starter adds WhatsApp Web tools and connects to Hiperchat servers with your WhatsApp ID on every load.

Hide Spoilers works with Paramount Plus collects your Paramount+ account, subscription, and viewing activity and sends it to its own server.

Majembu reads your Instagram DM conversations and profile info and sends them to its own server to draft and auto-send AI replies.

Micode WebPhone lets any web page trigger outbound VoIP calls from the user's logged-in softphone account.

Newtabtvds replaces the default search provider with search.newtabtv.com over plain HTTP.

Preplarge sends your Amazon Seller Central inventory report to app.preporder.com every 3 hours.

Prepod Pro LITE sends test questions and answer options from prepod.nspu.ru to OpenRouter when the AI-solve button is clicked.

RealityCheck sends the page's visible text to Anthropic's API and renders the streamed reply in its popup with unescaped HTML.

Similar Feed automatically reads up to 500 recent history items and all bookmarks each day and sends up to 30 of them to a backend.

TELEFON CONECTA adds CRM and automation tools to WhatsApp Web and sends voice messages to hc-stt.hiperchat.com.br on request.