Is Designer Daily Report safe?

Designer Daily Report exposes a postMessage handler that any webpage can use to open arbitrary tabs without origin validation.

The extension's popup page (index.html) is listed in web_accessible_resources with matches ['<all_urls>'], allowing any website to embed it in a hidden iframe. The embedded page registers a window message listener with no origin check, and two handler branches — CREATE_TAB and OPEN_PH_PAGE — call browser.tabs.create with caller-supplied URLs unconditionally. Additionally, when the popup loads, the extension attempts to strip X-Frame-Options and Content-Security-Policy response headers from all sub-frames browser-wide for the duration of the session via a declarativeNetRequest session rule.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.