Is Automation Anywhere safe?
Automation Anywhere bridges browser activity to a locally installed RPA agent and forwards external web page messages to native host 'aa.browser.shim' without payload validation.
The extension connects to a locally installed Automation Anywhere native agent via WebSocket and native messaging, passing DOM trees, form values, URLs, and page titles on demand. Content scripts running on all HTTP/HTTPS/file pages serialize full page structure when the native agent issues a CREATE_AVATAR command. An onMessageExternal handler accepts messages from automationanywhere.digital and supremomono.com domains and relays them verbatim to the native host, meaning any XSS on those domains could send arbitrary commands to the local process.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 11.2.0.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
http://*/*
Read and change your data on every secure site you visit
https://*/*
Talk to a program installed on your computer, outside the browser's sandbox
nativeMessaging
See the address and title of every tab you have open
tabs
See every page you navigate to, as you navigate to it
webNavigation
Where it sends data
Destinations our analysis observed Automation Anywhere contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- aa.browser.shim (local native host)
Automation Anywhere sends data to aa.browser.shim (local native host). Named as a recipient in this extension's own analysis.
- automation.chrome.agent (local native agent)
Automation Anywhere sends data to automation.chrome.agent (local native agent). Named as a recipient in this extension's own analysis.