Is Citavi Picker safe?

Question

Accepted Answer

Citavi Picker is medium risk. When Citavi Picker is installed, a browser-wide declarativeNetRequest rule removes the Cross-Origin Resource Sharing (CORS) protection from www.sciencedirect.com for all XHR requests in your browser. Any web page open in that browser session — including untrusted sites — can issue requests to sciencedirect.com and read the responses that your browser's same-origin policy was designed to protect. Dynamic analysis confirmed that a cross-origin XHR to a sciencedirect.com API endpoint returned a non-empty response body from a third-party origin; the same request fails with a CORS error when the extension is not installed.

Is Citavi Picker safe?

Findings