Low risk browser extensions

Easy QR posts its extension ID into Google pages where page scripts can read the message type.

Economic Calendar, Market & News sends popup page-view analytics events to Google Analytics.

Elevate Tab routes new-tab searches to search.elevatetab.com over cleartext HTTP, attaching a persistent per-user ID with each query.

Embark - New Tab Page sends TrackJS usage telemetry from its new-tab and options pages.

Excellent Data Filler injects content scripts on every page that hook network requests and accept unvalidated postMessage commands from any web origin.

F.Block Sponsored sends its Facebook ad-block counter to fblocksponsored.de during updates and uninstall setup.

Faceit EGO Enhancer embeds a clash.gg gambling ad iframe with affiliate tracking on FACEIT room pages.

FastStunnel VPN can fetch an HTTP bootstrap file that selects the API server receiving login credentials and session tokens.

Fenerbahçe SK Anasayfa's new-tab search box loads and executes remote JavaScript returned by a third-party search API.

Quick Grammar Fixer & AI Proofreader sends selected or typed text to a Vercel-hosted grammar API when you check grammar.

Flowith Web Clipper sends clipped content to Flowith's dev-edge server with a bundled API key.

Frontier Slither exposes its ID, version, and detected Slither-related extensions to Slither pages.

FunPay Tools sends chat history and seller draft text to fptools.onrender.com for AI assistance.

Funkify - Disability Simulator lets parent pages trigger clicks inside cross-origin iframes through its content script.

GO-Global exposes a web-accessible page that any website can use to relay arbitrary parameters, including credentials, to the locally installed GO-Global client via native messaging.

GPT for Ecom fetches Etsy listing and shop pages from server-directed queues and uploads the page HTML to Alibaba OSS.

Gloom Dark Mode sends a persistent locally stored UUID to Google Analytics at startup and every hour.

Google Images Restored accepts window messages from any page with no origin check, letting an attacker replace the full-size image link.

Grasp fetches and executes remote interface scripts from prod.shield.grasp.gg inside supported ad-platform pages.

Headline Studio by CoSchedule accepts postMessage commands from any ngrok.io tunnel, allowing manipulation of CMS title fields and stored credentials.

HoneyBook Extend lets Gmail pages request stored extension data and route authenticated calls to HoneyBook's API.

Hulu Picture In Picture [QVI] sends logged-in Hulu viewing history and account/profile data to me3x.online.

IDM - Download Manager Extension checks a Blogger page and opens a remote-specified URL in an active tab.

IDM - Trial Reset Tool 2026 lets pages trigger its optional widget to clear that site's cookies and browser storage.

IDRISS exposes its extension ID and stored extension settings to scripts on any website.

Join dispatches remote-control commands received via push notification through eval() with no signature check.

Lector Biblioteca Ceibal lets approved reading sites query and remove matching browser bookmarks.

LeetCode Video Solutions renders video-search results from lvsapi.soumya.dev as HTML on LeetCode problem pages.

Letterboxd Extras uses a built-in Kinopoisk API key for optional Kinopoisk rating requests.

Link Grabber sends link-selection actions and the current page URL to Google Analytics.

Looker Studio Auto Refresh sends a browser-derived identifier to Google Analytics when its popup opens.

MONKNOW New Tab looks up your public IP address to infer your weather location.

Magoosh Vocabulary sends pronunciation lookup words and its embedded Wordnik API key to api.wordnik.com over HTTP.

Mavryk Wallet replaces ads on all HTTPS pages with its own ads, using rules fetched from its servers.

Mayday lets any webpage with a spoofed trusted origin trigger ticket data to its recommendation API.

MeowLoad lets any web page ask it to open a supplied URL in a new browser tab.

Merkatys reads Wildberries search queries, product IDs, and auth tokens, and transmits them to its own servers.

Microsoft Dragon Copilot Web Extension exposes native hub data to every matched website.

Mitel Connect exposes account and call state to allowed GapiAuth pages and lets them trigger calls.

Mobile View injects a responsive-design overlay into web pages and stores device-selection preferences locally via chrome.storage.sync.

Mouse Pinch-To-Zoom exposes its extension ID to pages while handling zoom behavior.

Netflix - higher quality [QVI] turns Share Insights on by default and uploads streaming account data to me3x.online.

Netflix Dual Subtitles sends subtitle text, watch URLs, and page titles to Amplitude analytics on each translation event.

Night shift mode asks nightshiftmode.com for a URL and opens the returned page after install or update.

Online PDF Converter injects a floating PDF tools button and extension iframe into every visited site by default.

OpenWAX loads status-icon images from goonoo.github.io when you run an accessibility audit.

POE Trade zh fetches remote translation data from GitHub daily and writes it into page content on pathofexile.com without sanitization.

Pac Man Tribute sends a persistent Google Analytics client ID in recurring run events.

Paint - Easy Drawings stores drawing snapshots in each visited site's localStorage when its drawpad is used.

PitchBook Extension reports each active tab's domain to PitchBook profile lookup APIs.

Pixels Game Assistant loads a script URL from its own server's config and injects it into play.pixels.xyz with no integrity check.

Popup Blocker for Google Chrome injects a notification iframe that any page script can hide with a postMessage command.

Pure motion sends scoped video-page URLs and fetched provider HTML to www.thepuremotion.com.

Qudelix performs a cleartext IP geolocation lookup to ip-api.com when its extension UI loads.

RazorWave Video Downloader sends detected video page domains to Google's favicon service when its popup opens.

Recent Tabs displays recent tab titles, tab IDs, and favicon image URLs in the current page's DOM.

Replace Google CDN removes security headers from matching CDN responses before pages receive them.

Resize Gmail Sidebar by cloudHQ sends Gmail account identifiers to cloudHQ during Gmail page initialization.

Return YouTube Comment Username displays channel handles on YouTube comments and exposes a postMessage bridge to all YouTube-origin scripts.

Savefrom for vk content (ak. VK Saver) sends a stat beacon to aferon.com from VK-family video pages.