Is CheerpJ Applet Runner safe?

CheerpJ Applet Runner exposes a proxy frame that fetches caller-supplied URLs and returns the responses.

Its CheerpJ frame is web-accessible to any site and accepts a posted message port without checking the sender's origin. After the user grants this extension access to a site's origin, a page that embeds the frame can ask it to fetch URLs from that origin and receive the response bytes and metadata through the message port.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.