Is CFCA CryptoKit.XMYLSW Extension safe?
CFCA CryptoKit.XMYLSW Extension lets any xmztb.com page pick the native-messaging host and payload it forwards, with no allowlist.
This extension bridges bank pages on xmztb.com to a locally installed smart-card signing application via Chrome's native messaging. When a page on that domain sends a connect request, the extension passes the page-supplied host name straight to chrome.runtime.connectNative() and later relays the page-supplied payload to whichever native program that connects, without checking it against a fixed vendor host or command list. The domain is allowed over both https and unencrypted http, so the same bridge is reachable from a plaintext connection to the bank's site.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
Who publishes itCFCACryptoKit - 14 other listings from the same operator, none carrying a finding
CFCACryptoKit - 14 other listings from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
14 other listings published from this account, 1k+ users between them, none of them carrying a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 3.4.0.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on xmztb.com
https://*.xmztb.com/* and 1 more
Talk to a program installed on your computer, outside the browser's sandbox
nativeMessaging
Where it sends data
Destinations our analysis observed CFCA CryptoKit.XMYLSW Extension contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- locally-installed native messaging host (device-side, not a remote server)
CFCA CryptoKit.XMYLSW Extension sends data to locally-installed native messaging host (device-side, not a remote server). Named as a recipient in this extension's own analysis.