Is ePadLink SigCaptureWeb SDK safe?

Question

Accepted Answer

ePadLink SigCaptureWeb SDK is medium risk. The ePadLink SigCaptureWeb SDK Extension connects web pages to ePadLink signature-pad hardware installed on the user's computer. The content script is injected into every website the browser loads and listens for a custom DOM event without verifying which page fires it. Any website can set an arbitrary JSON value on a DOM element and dispatch SigCaptureWeb_SignStartEvent, causing the extension to forward that payload to the background service worker, which then opens a connection to the native host process com.epadlink.sigcapturewebsdk.win and sends the message verbatim. Dynamic analysis confirmed the relay: a test page dispatched the event and the extension relayed the page-supplied data to the background service worker, which then attempted a native messaging connection. The native software was not present in the test environment, so the range of commands the host accepts could not be fully assessed from the extension alone.

Is ePadLink SigCaptureWeb SDK Extension safe?

Findings