Is Allworx Interact Sync for Chrome safe?

Allworx Interact Sync relays extension messaging to all web pages, allowing any site to trigger native phone calls through the local Allworx dialer application.

The extension's content script registers a CustomEvent listener on every page visited that forwards events directly into chrome.runtime.sendMessage without any origin check. Any web page can dispatch a crafted CustomEvent to instruct the extension's background script to send a native message to the locally-installed Allworx dialer application, causing it to dial an attacker-supplied phone number. The privileged native messaging channel is accessible to all web origins because CustomEvents share the window object between page scripts and content scripts.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.