Low risk browser extensions

Rutoken Plugin Adapter bridges every visited page to a native Rutoken hardware token host via a postMessage relay with no origin restriction.

Sink It for Reddit routes video downloads through installation04.gosinkit.com, sending Reddit post IDs to that third-party server.

Flight Tab Pro redirects all address-bar and new-tab searches through Yahoo affiliate URLs that pay the publisher per query.

WEB.DE MailCheck for Firefox enables analytics on update and ships hardcoded OAuth client secrets for four mail providers.

Majestic Mountain Views sends every new-tab search query to landscape-extensions.com instead of your default search engine.

City Scapes sends every new-tab search query to a third-party monetized search proxy instead of your browser's default search engine.

Beautiful Beaches sends new-tab search queries to a third-party search proxy instead of the browser's default search engine.

CS2 Trader scrapes Steam API keys and access tokens from Steam pages on install and sends item inspection data to its developer backend.

30 Seconds of Knowledge sends page-view telemetry from its new tab and UI pages to Google Analytics with persistent IDs.

ATLANTIS 3D Editor Launcher forwards messages from vendor web pages to a native host without input validation.

AYAYADASH - Anime Dashboard sends the user's IP address to ip-api.com to load weather for its new-tab page.

Ad Blocker Chrome extension sends install and update telemetry with a persistent user ID and browser/system fingerprint.

AdBlock Detector Bypass by CPE lets any webpage save hidden-element rules that later hide matching content on chosen sites.

AiPrice(AliPrice) Search by image for AE accepts page messages that can open attacker-chosen tabs or windows.

Amazing Screen Recorder sends a persistent pseudonymous UUID to Google Analytics on every startup and once per hour.

Amazon Dark Mode loads its popup stylesheet from jsDelivr when the extension UI opens.

Adds in-app guidance and automation support for browser-based software.

AppSheet Toolbox removes framing protections from Google AppSheet support pages so it can display them in its drawer.

Atlan exposes its install/configuration status and saved language to any website through its external message API.

Augnito captures microphone audio and streams it to the Augnito speech backend, then writes the returned transcription into the active page's text field.

AutoTyper sends logged-in NitroType user IDs and tier values to autotyper.extreg.org from the garage page.

Birthday Calendar Exporter for Facebook scans Facebook for friends' birthdays and stores names, IDs, and dates locally.

BitsLab Safe sends every visited URL and a persistent device identifier to its own servers, and transmits wallet and transaction details to Mixpanel.

Bloomberg Terminal: Clip to NOTE lets any web page submit supplied files and notes to Bloomberg ClipServ.

BrowserTab sends address-bar searches to queryzoom.com after setting it as the default search provider.

Bulk Image Downloader From Url List can write your stored account email and license status into matching webpages.

CFCA CertEnrollment.SRCB Extension bridges SRCB bank pages to locally installed native messaging hosts without validating the host name.

CFCA CryptoKit.SRCBSCF Extension bridges CFCA-affiliated banking pages to a local native messaging host for cryptographic operations.

CFCA WebSeal.SRCB Extension bridges bank web pages to local native security software via native messaging, accepting the target host name from the calling page without validation.

ChatGPT Optimizer sends user-selected page text to ChatGPT and user-entered URLs to productivity.rocks.

ChatGPT for Gmail sends your Gmail account email, timezone, and selected draft text to Salesgear AI endpoints.

Chatwork Quick Info Input injects Google Fonts into ChatWork pages, sending referrer and IP metadata to Google.

Claude Fable 5 Limit & Usage Tracker - ClaudeKarma sends daily health counters, version, OS, and language to TokenKarma.

Claude QoL lets scripts on Claude pages read its stored text-to-speech provider API key through a postMessage settings bridge.

Colorway is a color-picker that, once opened on a tab, accepts page messages with no origin check to capture a screenshot or write its storage.

Conductor for Chrome reports every page URL you visit to its background worker and sends on-page SEO scrapes to Conductor for signed-in users.

Convert HEIC to JPG injects a hidden onlineapp.pro paywall iframe into every page and runs a leftover dev hot-reload client on localhost.

Country Flags & IP Whois loads a GeoLite2 database from a CDN without integrity checks to resolve page IP addresses to countries.

Crunchbase sends LinkedIn parser errors, including page DOM snippets and URL context, to Sentry.

Delete Facebook™ Posts, Photos, etc. loads remote SocialErase news HTML into its popup.

DeleteTweets sends its paid license key over cleartext HTTP and reads your logged-in Twitter/X bearer token to drive bulk tweet deletion.

Demandware With Ease sends encoded Salesforce Commerce Cloud account fields to Google Analytics on each Demandware instance visit.

Dino 3D inserts a quick-access button into webpages that exposes its extension ID in page-visible DOM IDs.

Discord Chat Export Tool copies your Discord authorization token into a page-readable body attribute on discord.com.

Dmooji - YouTube Danmaku reports YouTube live chat visits with persistent identifiers to Dmooji.

Doge Labs Wallet lets any top-level website request your wallet public key, balance, and inscriptions without connection approval.

Download Blocker intercepts browser downloads and blocks HTML smuggling attacks based on enterprise-configurable file inspection rules.

Dragon Medical Web Extension accepts postMessage without origin checks on all pages, allowing any site to inject text into active editors.

Easy QR posts its extension ID into Google pages where page scripts can read the message type.

Economic Calendar, Market & News sends popup page-view analytics events to Google Analytics.

Elevate Tab routes new-tab searches to search.elevatetab.com over cleartext HTTP, attaching a persistent per-user ID with each query.

Embark - New Tab Page sends TrackJS usage telemetry from its new-tab and options pages.

Excellent Data Filler injects content scripts on every page that hook network requests and accept unvalidated postMessage commands from any web origin.

Export Followers free proxies Instagram profile avatar URLs through cdn.getwebooster.workers.dev in export results.

F.Block Sponsored sends its Facebook ad-block counter to fblocksponsored.de during updates and uninstall setup.

Fable sends active-tab URLs to Segment and accepts page messages that forward URLs and page snippets to Fable.

FastStunnel VPN can fetch an HTTP bootstrap file that selects the API server receiving login credentials and session tokens.

Fenerbahçe SK Anasayfa's new-tab search box loads and executes remote JavaScript returned by a third-party search API.

Findymail checks postMessage sender origin with a substring match, then writes the message data into the LinkedIn page via innerHTML.