Is Apia digital signature safe?
Apia digital signature lets matching webpages send local signing data to its native signing host.
When a webpage URL contains firefoxSignature.jsp, the extension reads that page's localStorage dataToSign value and sends it to the Apia native signing application. The background script forwards the page-provided signing parameters through Firefox native messaging without checking the sender origin.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 1.6. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on developer.mozilla.org
*://developer.mozilla.org/*
Act on the current tab, but only after you click the extension
activeTab
Talk to a program installed on your computer, outside the browser's sandbox
nativeMessaging
Where it sends data
Destinations our analysis observed Apia digital signature contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- com.apia.sign.firefox
Apia digital signature sends data to com.apia.sign.firefox. No other extension we have analysed sends data here.