Low risk browser extensions

ScratchTools for Scratch sends enabled feature settings to its server and includes them in its uninstall URL.

Search Potato loads externally hosted S3 content whenever its new tab page opens.

SimilarTube reads the public contact email off YouTube channel About pages and sends it, plus your account name, to its own servers.

Spelunky Classic sends a persistent extension-local client ID to Google Analytics when it runs and every hour afterward.

Spoken sends shopping page URLs and related product image or page data to Spoken and PostHog services.

SpyHunter Web Security forwards navigated URLs to its backend and transmits hardware IDs and browsing statistics to Google Analytics.

Squadrats Route Planning copies its persistent UID into localStorage on supported route-planning sites.

Super Sound Booster sends a persistent per-installation UUID to Google Analytics every 60 minutes.

TABLERONE tab manager lets matching external pages request active-tab and saved-session metadata.

Tables for Gmail by cloudHQ sends Gmail account email addresses to cloudHQ during Gmail startup.

The Guestbook Extension loads RudderStack-controlled scripts on travel and hotel pages.

To-do List Chrome Extension sends a persistent visitor ID to onlineapp.pro during its new-tab paywall flow.

Tonalis Audio Recorder sends hourly Google Analytics events with a persistent extension-generated client ID.

TopCash lets any webpage ask the extension to open an attacker-chosen URL in a new tab.

UTN.BA Helper uploads hashed student IDs, academic data, class schedules, and survey responses to its developer backend.

Udemy Course Downloader opens an affiliate tracking tab on install and when downloads start.

Ultra Volume Booster captures tab audio to amplify volume and sends usage telemetry to Google Analytics on startup and hourly.

UltraWide Streaming sends Disney+ and Amazon/Prime Video account, profile, and viewing data to me3x.online.

VTopNaMP intercepts Wildberries search queries and product browsing data and transmits them via WebSocket to wss.wbservices.ru.

WA Web Utils - Message Sender sends your WhatsApp account phone number to its subscription-status API.

WAContactSaver sends WhatsApp Web page telemetry to Google Analytics after injecting its bundled script.

WARocket Sender injects WA-JS into WhatsApp Web and sends page telemetry with a persistent client ID to Google Analytics.

Wordle Timeless sends a persistent extension client ID and hourly run events to Google Analytics.

Workmind sends supported search-result queries to ChatGPT for answer generation.

Zluri Web Extension logs every page visited across all websites and uploads the browsing history to its own servers.

ZoneAlarm Web Secure authenticates to its local security agent using an API key hardcoded identically in every install.

adam:ONE assist sends failed HTTPS navigation hostnames over HTTP to mytools.management.

cat-catch lets any HTTP(S) page send background commands that can turn on auto-download and queue media URLs.

color picker for website - monster pick contacts colorpicker.monster on install/update and can open a server-provided tab.

iPacket SalesHub sends user email and vehicle appraisal details to PostHog during value appraisal actions.

m1pro sends Monopoly One page titles and URLs with a persistent client ID to Google Analytics.

right-click QRcode reader decodes a QR image locally, then opens the decoded text as a new-tab URL after a single OK prompt.

Auto Price Checker sends product page details to kakaku-navi.net for price comparison.

Sink It for Reddit routes video downloads through installation04.gosinkit.com, sending Reddit post IDs to that third-party server.

Weather Extension transmits your precise GPS coordinates and a persistent installation identifier to its servers every 60 minutes.

Eno from Capital One scans page structure on all sites and sends URL, referrer, and session identifiers to Capital One analytics.

Mate Translate sends daily translation statistics and account email to Gikken servers and transmits a persistent device ID at install time.

ImageAssistant sends a persistent per-install tracking ID and extension version to pullywood.com on every startup.

Location Guard ships a hardcoded third-party geocoding API key in its extension bundle.

GMX MailCheck for Firefox ships hardcoded OAuth2 client secrets and may silently enable telemetry during version upgrades.

Foxy Gestures is a local mouse-gesture extension that operates entirely within the browser with no external data transmission.

Colorpick Eyedropper ships a hardcoded Google Safe Browsing API key in its bundle that any user can read.

Yandex — Homepage sends a persistent browser UUID and extension runtime ID to Yandex servers at startup and every two hours.

Season Pass Pass intercepts Bungie API keys from network headers and redirects Settings API calls to a third-party Cloudflare Worker.

Wanteeed tracks visited merchant URLs, referrers, and co-installed extensions, and sends this data to its analytics servers.

Distill Web Monitor sends monitored page URLs and tab URLs to Sentry error reporting when exceptions occur.

Synology Image Assistant Extension accepts postMessage commands from any webpage, enabling relay to the local Synology desktop client.

Cashback Assistent von Shoop.de injects a version meta tag into every page and sends analytics to Google via a hardcoded API secret.

Reverse Image Search exposes a web-accessible page that accepts form-submit commands via postMessage from any web origin.

Productivity Boost & Search overrides the default search engine to Yahoo with affiliate tracking and sends IPs to productivityboost.net.

WebRTC Leak Shield permanently exempts its developer domain 'interdrop.com' from WebRTC blocking without disclosing this to the user.

MAL-Sync embeds hardcoded OAuth client secrets for three third-party services in its extension bundle.

Open in IE exposes a shared DOM channel that any webpage can use to open an attacker-chosen URL in Internet Explorer.

User-Agent Switcher writes the configured UA string to each page's localStorage, where any page script can read it.

LibKey Nomad assigns a persistent device UUID and transmits it alongside browser details to a.thirdiron.com on every article interaction.

Internet Archive Downloader sets CORS headers on archive.org responses to allow credentialed cross-origin fetches when downloading books.

easyScholar displays journal rankings on academic pages and routes translation requests through its own servers and third-party APIs.

Runet Censorship Bypass routes browser traffic through third-party proxies and re-fetches its PAC script from remote URLs every 12 hours.

Pixiv Toolkit overrides CORS headers on Pixiv and pximg domains, allowing any webpage to read image resources cross-origin.

anonymoX allows its VPN master server to open arbitrary URLs in new tabs on every periodic check-in.