Low risk browser extensions

Convert HEIC to JPG injects a hidden onlineapp.pro paywall iframe into every page and runs a leftover dev hot-reload client on localhost.

Country Flags & IP Whois loads a GeoLite2 database from a CDN without integrity checks to resolve page IP addresses to countries.

Crunchbase sends LinkedIn parser errors, including page DOM snippets and URL context, to Sentry.

Delete Facebook™ Posts, Photos, etc. loads remote SocialErase news HTML into its popup.

Demandware With Ease sends encoded Salesforce Commerce Cloud account fields to Google Analytics on each Demandware instance visit.

Dino 3D inserts a quick-access button into webpages that exposes its extension ID in page-visible DOM IDs.

Discord Chat Export Tool copies your Discord authorization token into a page-readable body attribute on discord.com.

Dmooji - YouTube Danmaku reports YouTube live chat visits with persistent identifiers to Dmooji.

Doge Labs Wallet lets any top-level website request your wallet public key, balance, and inscriptions without connection approval.

Download Blocker intercepts browser downloads and blocks HTML smuggling attacks based on enterprise-configurable file inspection rules.

Dragon Medical Web Extension accepts postMessage without origin checks on all pages, allowing any site to inject text into active editors.

Easy Print transmits every search keystroke typed into its new-tab page to easyprintapp.net as autosuggest requests.

Easy QR posts its extension ID into Google pages where page scripts can read the message type.

Economic Calendar, Market & News sends popup page-view analytics events to Google Analytics.

Elevate Tab routes new-tab searches to search.elevatetab.com over cleartext HTTP, attaching a persistent per-user ID with each query.

Embark - New Tab Page sends TrackJS usage telemetry from its new-tab and options pages.

Excellent Data Filler injects content scripts on every page that hook network requests and accept unvalidated postMessage commands from any web origin.

Export Followers free proxies Instagram profile avatar URLs through cdn.getwebooster.workers.dev in export results.

F.Block Sponsored sends its Facebook ad-block counter to fblocksponsored.de during updates and uninstall setup.

FastStunnel VPN can fetch an HTTP bootstrap file that selects the API server receiving login credentials and session tokens.

Fenerbahçe SK Anasayfa's new-tab search box loads and executes remote JavaScript returned by a third-party search API.

Findymail checks postMessage sender origin with a substring match, then writes the message data into the LinkedIn page via innerHTML.

Floating Scientific Calculator sends current-page Sentry telemetry after page-triggered extension messages.

Flowith Web Clipper sends clipped content to Flowith's dev-edge server with a bundled API key.

Foxit PDF Editor Cloud lets websites invoke its viewer to fetch a supplied URL and pass the response to Foxit cloud.

Frontier Slither exposes its ID, version, and detected Slither-related extensions to Slither pages.

FunPay Tools sends chat history and seller draft text to fptools.onrender.com for AI assistance.

GNT: Glass New Tab sends weather lookup requests to WeatherAPI.com from its new tab weather widget.

GO-Global exposes a web-accessible page that any website can use to relay arbitrary parameters, including credentials, to the locally installed GO-Global client via native messaging.

GPT for Ecom fetches Etsy listing and shop pages from server-directed queues and uploads the page HTML to Alibaba OSS.

Gloom Dark Mode sends a persistent locally stored UUID to Google Analytics at startup and every hour.

HBOmax Skipper sends account-linked Max profiles, viewing history, and live-event telemetry to external servers.

Headline Studio by CoSchedule accepts postMessage commands from any ngrok.io tunnel, allowing manipulation of CMS title fields and stored credentials.

HoneyBook Extend lets Gmail pages request stored extension data and route authenticated calls to HoneyBook's API.

Hulu Picture In Picture [QVI] sends logged-in Hulu viewing history and account/profile data to me3x.online.

IDM - Download Manager Extension checks a Blogger page and opens a remote-specified URL in an active tab.

IDRISS exposes its extension ID and stored extension settings to scripts on any website.

Join dispatches remote-control commands received via push notification through eval() with no signature check.

LeetCode Video Solutions renders video-search results from lvsapi.soumya.dev as HTML on LeetCode problem pages.

Letterboxd Extras uses a built-in Kinopoisk API key for optional Kinopoisk rating requests.

Libdata App Extension routes all browser traffic through a configured proxy and answers any HTTP auth prompt with its proxy credentials.

Link Grabber sends link-selection actions and the current page URL to Google Analytics.

Looker Studio Auto Refresh sends a browser-derived identifier to Google Analytics when its popup opens.

Magoosh Vocabulary sends pronunciation lookup words and its embedded Wordnik API key to api.wordnik.com over HTTP.

Mavryk Wallet replaces ads on all HTTPS pages with its own ads, using rules fetched from its servers.

Mayday lets any webpage with a spoofed trusted origin trigger ticket data to its recommendation API.

Merkatys reads Wildberries search queries, product IDs, and auth tokens, and transmits them to its own servers.

Microsoft Dragon Copilot Web Extension exposes native hub data to every matched website.

Mitel Connect exposes account and call state to allowed GapiAuth pages and lets them trigger calls.

Mobile View injects a responsive-design overlay into web pages and stores device-selection preferences locally via chrome.storage.sync.

Mouse Pinch-To-Zoom exposes its extension ID to pages while handling zoom behavior.

NFC Reader - Browser Extension relays arbitrary commands from any webpage to a locally connected NFC reader via native messaging.

Netflix - higher quality [QVI] turns Share Insights on by default and uploads streaming account data to me3x.online.

Night shift mode asks nightshiftmode.com for a URL and opens the returned page after install or update.

Online PDF Converter injects a floating PDF tools button and extension iframe into every visited site by default.

OpenWAX loads status-icon images from goonoo.github.io when you run an accessibility audit.

POE Trade zh fetches remote translation data from GitHub daily and writes it into page content on pathofexile.com without sanitization.

Pac Man Tribute sends a persistent Google Analytics client ID in recurring run events.

Paint - Easy Drawings stores drawing snapshots in each visited site's localStorage when its drawpad is used.