Is Dragon Ext. safe?

Question

Accepted Answer

Dragon Ext. is high risk. We observed that the Dragon Medical extension's native-messaging SSO-launch relay lost the setting that used to gate it. In the last-reviewed release, forwarding a username to the locally installed Dragon Medical native application over native messaging only happened if you had explicitly turned the feature on from the extension's options page; the code comment next to that check read "disabled by default for security." In this release, that check -- and the options page that controlled it -- has been deleted. Because the extension's content script runs on every page and every frame you visit, any website's own script can now fire a browser event carrying any username it chooses, and the extension immediately hands that value to the native application as an SSO-launch request, with no settings check and no prompt. During dynamic analysis we substituted a distinguishing marker value for the username and confirmed it reached the native messaging channel unmodified. What the native application itself does with a forged username was not directly observed, since the native host was not decompiled as part of this review. We observed that the Dragon Medical extension's internal cross-frame messaging channel no longer checks who it is talking to. In the last-reviewed release, this channel only accepted a message from a window it had explicitly registered as a trusted parent or child frame, or that carried a matching one-time session token; outbound replies were sent to that specific known origin. In this release, both checks -- and the code that implemented them -- have been removed. The channel now accepts any JSON-shaped message from any window and processes it as if it came from a legitimate connected frame, and its own replies are posted to any listener (targetOrigin '*') instead of the intended recipient only. Because this messenger is created by a content script that runs on every page and every frame, an untrusted iframe or window anywhere on any page you visit can send it a forged message. During dynamic analysis, we sent a forged message from a window that had never been registered with the extension and observed the extension process it and reply with its internal handshake messages, confirming the missing check. We did not build a full exploit chain showing data exfiltration through a specific message handler; the finding is that a previously-implemented allowlist was completely removed.

Is Dragon (DMO, DMD, DPA, DLA) Web Extension safe?

Findings