Is Cold Turkey Blocker safe?

Cold Turkey Blocker's block-page frame accepts unblock commands from any origin, allowing a blocked site to remove its own block.

When Cold Turkey Blocker blocks a tab, it injects an iframe pointing to ctFrame.html. The frame's postMessage handler processes an 'unblock tab' command without checking the sender's origin, so any script still running on the blocked page can read the block parameters from the iframe URL and send a message that unblocks the tab for up to 30 minutes. No user data is transmitted externally; the vulnerability is limited to bypass of the extension's own blocking controls.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.