Is ActivID CMS safe?

Question

Accepted Answer

ActivID CMS is medium risk. The ActivID CMS Chrome extension injects its content script on every HTTPS website visited. Dynamic analysis confirmed that any HTTPS page can dispatch a 'load-hid-extension' browser event to activate the extension, which then opens a native messaging connection to the ActivID CMS client software installed on the device. The extension performs no check on which website dispatches this event before opening the native messaging session. An attacker who controls an HTTPS page visited by a user who has both the extension and ActivID CMS installed can activate the bridge and relay base64-encoded commands to the local native host via DOM input elements. The scope of impact depends on what operations the ActivID CMS native host accepts and whether it enforces its own caller validation.

Is ActivID CMS extension safe?

Findings