Low risk browser extensions

Stylus (beta) applies user-authored CSS styles to websites and includes hardcoded OAuth client secrets for optional cloud sync providers.

SubTrans sends tab URLs, page titles, and account identifiers alongside subtitle text to its translation and analytics servers.

TRAVIC-Sign runs content scripts on all URLs and allows its local native signing host to direct credentialed HTTP requests to arbitrary URLs.

The World Tab replaces the new tab page and sends search queries to the publisher's own search domain.

Theme & Color Changer for YouTube opens promotional tabs on install and every update without user interaction.

TrustPlugin relays cryptographic signing requests from any web page to a native PKI host without validating the message origin.

Userlane transmits visited URLs and user identifiers to its servers and sends session tokens as metadata to a third-party error tracker.

VHelper generates a browser/device fingerprint on Amazon Vine pages and uploads it to api.v-helper.com.

Video Downloader for reddit - Redditsave routes download actions through rapidsave.com with an affiliate referral tag appended to each URL.

WABiz Free Bulk Sender (Lite) sends the user's WhatsApp phone number to wabiz.in every five minutes for license validation.

Woodwo New Tab replaces every new tab with an instant redirect to www.woodwo.net.

X (Twitter) Mass Unfollow loads remote GitHub images on X following pages.

XolidoSign relays page messages to a local native crypto-signing component without validating the sender's origin domain.

folkX captures visible profile data from Gmail, X, Instagram, TikTok, WhatsApp, Facebook, and Meet and syncs it to its own CRM backend.

qTest Integration fetches any caller-supplied URL via the extension's broad host permissions, allowing pages to bypass CORS restrictions.

widget.io injects a page-context script into StreamElements overlay pages that accepts postMessage commands from any origin.

The extension sends session cookies to Mail.Ru's advertising platform and transmits daily telemetry with a persistent install ID to Mail.Ru analytics endpoints.

字幕精灵 captures tab audio and streams it to its servers automatically when the extension starts.

Worldwide Radio removes Do Not Track and Origin headers from radio stream requests before they are sent.

YouTube Downloader (UDL Helper) sends browser cookies to a third-party tracking domain before the user accepts any consent prompt.

JavaScript-Java Bridge relays messages between webpages and locally installed Java programs via native messaging, with no validation of which Java host a page may connect to.

Sky Follower Bridge routes Bluesky avatar image requests through the developer's proxy server, disclosing which profiles are being compared.

Photo Editor & Search sets the default search engine to a Yahoo affiliate URL that routes search queries through publisher tracking codes.

Task Manager Tab & Custom Web Search sends geolocation data to its servers and redirects searches through a Yahoo affiliate URL.

Video Downloader Pro embeds a hardcoded Twitter API credential that any user of the extension can extract.

Rutoken Plugin Adapter bridges every visited page to a native Rutoken hardware token host via a postMessage relay with no origin restriction.

NeatDownloadManager Extension forwards detected download links, cookies, and headers to the local NDM app via a loopback WebSocket.

Sink It for Reddit routes video downloads through installation04.gosinkit.com, sending Reddit post IDs to that third-party server.

WEB.DE MailCheck for Firefox enables analytics on update and ships hardcoded OAuth client secrets for four mail providers.

Flight Tab Pro redirects all address-bar and new-tab searches through Yahoo affiliate URLs that pay the publisher per query.

CS2 Trader scrapes Steam API keys and access tokens from Steam pages on install and sends item inspection data to its developer backend.

30 Seconds of Knowledge sends page-view telemetry from its new tab and UI pages to Google Analytics with persistent IDs.

AEM Sidekick lets external webpages request temporary cache-bypass header changes for chosen HTTPS hosts.

ATLANTIS 3D Editor Launcher forwards messages from vendor web pages to a native host without input validation.

Ad Blocker Chrome extension sends install and update telemetry with a persistent user ID and browser/system fingerprint.

Adobe Experience Cloud Visual Editing Helper lets the first authoring message origin control page DOM edits.

AiPrice(AliPrice) Search by image for AE accepts page messages that can open attacker-chosen tabs or windows.

Amazing Screen Recorder sends a persistent pseudonymous UUID to Google Analytics on every startup and once per hour.

Amazon Dark Mode loads its popup stylesheet from jsDelivr when the extension UI opens.

AppSheet Toolbox removes framing protections from Google AppSheet support pages so it can display them in its drawer.

Atlan exposes its install/configuration status and saved language to any website through its external message API.

Augnito captures microphone audio and streams it to the Augnito speech backend, then writes the returned transcription into the active page's text field.

AutoTyper sends logged-in NitroType user IDs and tier values to autotyper.extreg.org from the garage page.

BitsLab Safe sends every visited URL and a persistent device identifier to its own servers, and transmits wallet and transaction details to Mixpanel.

BlankNewTab loads each new tab inside a remote iframe hosted on Amazon S3.

Bloomberg Terminal: Clip to NOTE lets any web page submit supplied files and notes to Bloomberg ClipServ.

CFCA CertEnrollment.SRCB Extension bridges SRCB bank pages to locally installed native messaging hosts without validating the host name.

CFCA CryptoKit.SRCBSCF Extension bridges CFCA-affiliated banking pages to a local native messaging host for cryptographic operations.

CFCA WebSeal.SRCB Extension bridges bank web pages to local native security software via native messaging, accepting the target host name from the calling page without validation.

CaptchaMaster sends page screenshots and captcha images to a solver app running on your own computer.

Cars Lightning Speed sends your leaderboard nickname and score over cleartext HTTP to a Disney highscores server.

ChatGPT Optimizer sends user-selected page text to ChatGPT and user-entered URLs to productivity.rocks.

ChatGPT for Gmail sends your Gmail account email, timezone, and selected draft text to Salesgear AI endpoints.

Chatwork Quick Info Input injects Google Fonts into ChatWork pages, sending referrer and IP metadata to Google.

Claude Fable 5 Limit & Usage Tracker - ClaudeKarma sends daily health counters, version, OS, and language to TokenKarma.

Claude QoL lets scripts on Claude pages read its stored text-to-speech provider API key through a postMessage settings bridge.

Color Picker loads HTML from linangdata.com on every popup open and inserts it into the popup page.

Colorway is a color-picker that, once opened on a tab, accepts page messages with no origin check to capture a screenshot or write its storage.

Conductor for Chrome reports every page URL you visit to its background worker and sends on-page SEO scrapes to Conductor for signed-in users.