Is Elfster's Wish It! safe?

Elfster's Wish It! prefills its wishlist form from a browser message sent by any web page, with no check on who sent it.

The extension's wishlist-add popup listens for window messages and loads the product title, price, and images straight into the add-to-wishlist form without checking which page sent the message, so any website the user visits can inject fake product data as if it had been scraped from a real page. Separately, the extension's Elfster and OurWishesRegistry sign-in flows accept a message as authentic whenever the sender's origin merely contains the text "elfster.com" or "ourwishesregistry.com" rather than matching it exactly, a check a look-alike domain can also satisfy to supply a forged sign-in session.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.