Is Demandbase for Sales safe?

Demandbase for Sales lets any HTTPS page ask the extension to open an attacker-chosen URL in a new tab.

Its side-panel page is web-accessible and accepts postMessage commands without checking the sender's origin. Those messages are relayed through the extension's content and background scripts to chrome.tabs.create, so a web page can trigger a new tab for a chosen URL while the code path handles URL and tab context.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.