Is eBay Image Downloader safe?

eBay Image Downloader injects a page-script bridge into every frame that any embedded iframe can drive via postMessage.

The extension injects a script into the main world of every http(s) page and frame. That script accepts postMessage commands, gated only by a fixed string in the message, to read page properties, run supplied script, and read XHR request headers, and it posts results back to the sender. As a result, cross-origin iframes such as ads or embeds can run code in the top page's JavaScript context.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.