Low risk browser extensions

Quick Grammar Fixer & AI Proofreader sends selected or typed text to a Vercel-hosted grammar API when you check grammar.

Floating Scientific Calculator sends current-page Sentry telemetry after page-triggered extension messages.

Flowith Web Clipper sends clipped content to Flowith's dev-edge server with a bundled API key.

Frontier Slither exposes its ID, version, and detected Slither-related extensions to Slither pages.

FunPay Tools sends chat history and seller draft text to fptools.onrender.com for AI assistance.

Funkify - Disability Simulator lets parent pages trigger clicks inside cross-origin iframes through its content script.

GO-Global exposes a web-accessible page that any website can use to relay arbitrary parameters, including credentials, to the locally installed GO-Global client via native messaging.

GPT for Ecom fetches Etsy listing and shop pages from server-directed queues and uploads the page HTML to Alibaba OSS.

GeoSpoof sends your public IP address to external IP and geolocation providers during VPN sync.

Gloom Dark Mode sends a persistent locally stored UUID to Google Analytics at startup and every hour.

Google Images Restored accepts window messages from any page with no origin check, letting an attacker replace the full-size image link.

Headline Studio by CoSchedule accepts postMessage commands from any ngrok.io tunnel, allowing manipulation of CMS title fields and stored credentials.

HoneyBook Extend lets Gmail pages request stored extension data and route authenticated calls to HoneyBook's API.

Hulu Picture In Picture [QVI] sends logged-in Hulu viewing history and account/profile data to me3x.online.

IDM - Download Manager Extension checks a Blogger page and opens a remote-specified URL in an active tab.

IDM - Trial Reset Tool 2026 lets pages trigger its optional widget to clear that site's cookies and browser storage.

IDRISS exposes its extension ID and stored extension settings to scripts on any website.

Join dispatches remote-control commands received via push notification through eval() with no signature check.

LeetCode Video Solutions renders video-search results from lvsapi.soumya.dev as HTML on LeetCode problem pages.

Letterboxd Extras uses a built-in Kinopoisk API key for optional Kinopoisk rating requests.

Link Grabber sends link-selection actions and the current page URL to Google Analytics.

Looker Studio Auto Refresh sends a browser-derived identifier to Google Analytics when its popup opens.

Magoosh Vocabulary sends pronunciation lookup words and its embedded Wordnik API key to api.wordnik.com over HTTP.

Mavryk Wallet replaces ads on all HTTPS pages with its own ads, using rules fetched from its servers.

Mayday lets any webpage with a spoofed trusted origin trigger ticket data to its recommendation API.

MeowLoad lets any web page ask it to open a supplied URL in a new browser tab.

Merkatys reads Wildberries search queries, product IDs, and auth tokens, and transmits them to its own servers.

Microsoft Dragon Copilot Web Extension exposes native hub data to every matched website.

Mitel Connect exposes account and call state to allowed GapiAuth pages and lets them trigger calls.

Mobile View injects a responsive-design overlay into web pages and stores device-selection preferences locally via chrome.storage.sync.

Mouse Pinch-To-Zoom exposes its extension ID to pages while handling zoom behavior.

NFC Reader - Browser Extension relays arbitrary commands from any webpage to a locally connected NFC reader via native messaging.

Netflix - higher quality [QVI] turns Share Insights on by default and uploads streaming account data to me3x.online.

Netflix Dual Subtitles sends subtitle text, watch URLs, and page titles to Amplitude analytics on each translation event.

Night shift mode asks nightshiftmode.com for a URL and opens the returned page after install or update.

Online PDF Converter injects a floating PDF tools button and extension iframe into every visited site by default.

Open bookmarks in a new tab lets its bookmark proxy page redirect the current tab to a URL chosen in the page address.

OpenWAX loads status-icon images from goonoo.github.io when you run an accessibility audit.

POE Trade zh fetches remote translation data from GitHub daily and writes it into page content on pathofexile.com without sanitization.

Pac Man Tribute sends a persistent Google Analytics client ID in recurring run events.

Paint - Easy Drawings stores drawing snapshots in each visited site's localStorage when its drawpad is used.

PitchBook Extension reports each active tab's domain to PitchBook profile lookup APIs.

Pixels Game Assistant loads a script URL from its own server's config and injects it into play.pixels.xyz with no integrity check.

Popup Blocker for Google Chrome injects a notification iframe that any page script can hide with a postMessage command.

Pure motion sends scoped video-page URLs and fetched provider HTML to www.thepuremotion.com.

Qudelix performs a cleartext IP geolocation lookup to ip-api.com when its extension UI loads.

QuickSearch - חיפוש בטוח silently overrides the default search engine and homepage to redirect searches to quicksearch.pro.

RazorWave Video Downloader sends detected video page domains to Google's favicon service when its popup opens.

ReYohoho Twitch Extension sends your Twitch ID and watched channel to its backend for its friends feature.

Recent Tabs displays recent tab titles, tab IDs, and favicon image URLs in the current page's DOM.

Replace Google CDN removes security headers from matching CDN responses before pages receive them.

Resize Gmail Sidebar by cloudHQ sends Gmail account identifiers to cloudHQ during Gmail page initialization.

Return YouTube Comment Username displays channel handles on YouTube comments and exposes a postMessage bridge to all YouTube-origin scripts.

Savefrom for vk content (ak. VK Saver) sends a stat beacon to aferon.com from VK-family video pages.

ScratchTools for Scratch sends enabled feature settings to its server and includes them in its uninstall URL.

Search Potato loads externally hosted S3 content whenever its new tab page opens.

SimilarTube reads the public contact email off YouTube channel About pages and sends it, plus your account name, to its own servers.

Spelunky Classic sends a persistent extension-local client ID to Google Analytics when it runs and every hour afterward.

Spoken sends shopping page URLs and related product image or page data to Spoken and PostHog services.

SpyHunter Web Security forwards navigated URLs to its backend and transmits hardware IDs and browsing statistics to Google Analytics.