Is Click to component safe?
Click to component listens for window messages with no origin check, letting any page script redirect its next clicked-source URL.
The extension injects a script into every page's main world so developers can click a rendered React component and jump straight to its source in their editor. That script's window message listener does not check the sender's origin, so any other script running on the same page can overwrite the editor URL and delivery method it uses. On the developer's next inspect click, this lets the page redirect the local file path of the clicked component to an attacker-chosen destination instead of the intended local editor.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 1.2.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Act on the current tab, but only after you click the extension
activeTab
Add items to the right-click menu
contextMenus
Store data in your browser
storage