Low risk browser extensions

Fiorilli Web Extension lets any web page send commands to a local Fiorilli native client app.

FlowCrm adds a CRM overlay to WhatsApp Web and relays conversation data to its own FlowCrm servers.

FortiEDR Secure Browser reads the plaintext username and password from every web form you submit, on any site.

Fresh View Search sets itself as the default search engine and sends each omnibox query to freshviewlab.com.

GGSAP relays Taobao, Tmall and 1688 product data to khachhang.ggsap.vn for its ordering service.

Getquanty reads contact and company details from the pages you view and sends them to ext.getquanty.com.

Hugopaket adds a courier-dispatch button to restaurant partner panels and sends order details to hugopaket.app.

I9Chat sends the WhatsApp Web login QR code and, on paid plans, deleted messages to its own servers.

IBSextension lets any web page send arbitrary messages to a locally installed native app and read its replies.

InfinityChat reads WhatsApp Web chats and contacts and relays them to its own backend for CRM features.

The extension lets its vendor server read WhatsApp Web chats and messages on demand and sends them to inovstar.com.

Konverse adds a WhatsApp Web CRM overlay that sends chat data, including view-once and deleted messages, to its own API.

LeadHuntr lets any webpage that embeds WhatsApp Web read your groups and chats and send messages as you.

LockItDown Browser disables your other extensions and restricts browsing while an exam lockdown session is active.

Matbao Scan sends visited hostnames and detected technologies to ping.matbao.support by default.

MixChat adds a CRM overlay to WhatsApp Web and can send deleted and view-once messages to its servers.

MkZap adds a WhatsApp Web button that uploads a voice note's audio to hc-stt.hiperchat.com.br for transcription.

MultiAtendeFacil uploads deleted and view-once WhatsApp Web messages to its own servers when the premium module is on.

MyPoints Score sends logged-in members' visited merchant URLs and selected order data to a Prodege AWS Kinesis stream.

Myhome Daisy opens a web organizer at myhomedaisy.com and manages tabs and Google sign-in for it.

The extension lets any script on amazon.in trigger background fetches to attacker-chosen URLs and read back the response.

NumbChat uploads deleted and view-once WhatsApp messages and the login QR code to its own servers.

Obscured VPN routes all browser traffic through a vendor-supplied HTTP proxy and answers any HTTP auth prompt with your login.

Paketiniz.com reads delivery-platform order data from your browser tabs and sends it to Paketiniz servers.

Plagiatkontroll collects text you copy on 24 AI chat sites and uploads it with your Google Docs content.

RT-Booster removes frame-blocking headers from all Rakuten pages so it can show them in its side-panel phone view.

Rakuten Button Canada uploads the full HTML of order confirmation pages to capture.ecbsn.com after shopping trips.

Red Fly Digital sends WhatsApp Web view-once and deleted message contents to its own servers.

Renomate's login widget writes the user's account access token into the localStorage of whatever website the tab happens to be on.

Rota Lojistik copies customer order details from Turkish delivery partner portals to its own server when a button is clicked.

Routenplaner & Karten Holen sets g-maps.com as the default search provider, sending omnibox queries to that site.

Saber PB adds editing shortcuts to the Paraíba Saber platform and loads notice messages from a GitHub-hosted file.

SegChat sends WhatsApp Web deleted messages, view-once messages and webhook-bound message content to its own servers.

Seven7Chat uploads recalled and view-once WhatsApp Web messages to its own servers.

Spannel sends the content of deleted and view-once WhatsApp Web messages to its own servers.

StealItX sends every product-page URL you visit on Indian shopping sites to an affiliate link converter.

SuperBotChat sends WhatsApp Web login QR images, deleted and view-once messages to its own servers.

Surf Safe opens a pinned background tab to an affiliate link when you visit any of thousands of partner shops.

Tada Extension sends order history and merchant-page URLs to an AWS Firehose stream while you shop.

Tada Extension sends the IDs of your other enabled browser extensions to api.tada.com once a week.

TalkBee sends WhatsApp Web chat history, deleted messages and login QR codes to its own backend.

Talkyou adds CRM and automation tools to WhatsApp Web and sends message content to a server-configured API.

TechNow uploads other people's deleted and view-once WhatsApp Web messages to its own backend.

TooBot sends deleted and view-once WhatsApp Web messages, including media, to api.toobot.express.

Ultron DevTools sends the URL of each Taobao page you load to Alibaba's gm.mmstat.com tracker.

Vapt injects a vendor script into WhatsApp Web and uploads deleted and view-once message content to its servers.

Việt TaoBao sends Taobao, Tmall and 1688 product data and page text to its own order-proxy servers.

WF Tools sends your name, phone, email and onboarding answers to the vendor with every analytics event.

WMS App sends your WhatsApp phone number, name and Google email to its own Firebase backend.

Webmiru sends the domain, detected technologies and found emails of each viewed site to a publisher-run Google Apps Script.

WesccTech sends WhatsApp Web deleted and view-once message content to its own backend.

WhiteZap sends the content of deleted and view-once WhatsApp Web messages to its own servers.

WplusChat uploads the original text of messages deleted in WhatsApp Web to its own backend.

Wpplus copies WhatsApp Web messages in memory and sends deleted and view-once messages to its own API.

YOXO Eco sends the full URL of matched pages, with a persistent user ID, to Google Analytics on every page load.

Zampi CRM adds a WhatsApp Web CRM layer and strips WhatsApp's page security headers to do so.

Zapidex lets api.zapidex.com read and send WhatsApp Web messages and uploads chats, deleted messages and login QR codes.

NeuroChat adds a WhatsApp Web CRM overlay that sends deleted and view-once message content to its own API.

StreamFab OnlyFans Downloader sends the active tab's full URL, device IDs and account email to DVDFab telemetry servers.

youside youtube sidebar rewrites headers on every youtube.com request to embed YouTube in its side panel.