Is Fedica safe?

Medium risk

Fedica is medium risk. When you use Fedica's browser action, the extension injects iframes from fedica.com into the page. These load content from fedica.com/browserplugin/browsertest and exchange postMessage events with the extension for reload and logoff.…

Fedica Group publisherv3.11Chrome Web Store
49Risk
Who publishes it

Fedica Inc - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Fedica Group publisher
Declared legal entity
Fedica Inc
Registered address
18 King St E Suite #1400, Toronto, ON M5C 1C4, CA
Registered contact
Samir Al-Battran
Website
fedica.com/info/contact

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Fedica injects remote iframes into visited pages after user action.

When you use Fedica's browser action, the extension injects iframes from fedica.com into the page.

These load content from fedica.com/browserplugin/browsertest and exchange postMessage events with the extension for reload and logoff.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

You use the Fedica browser action.

The extension did this

The extension injects fedica.com iframes into the current page and listens for their messages.

Captured request
GETfedica.com/browserplugin/browsertest
Observation

Observed during dynamic analysis: the extension has broad http and https host access, sends a browser-action message to start this flow, creates fedica.com iframes, and accepts fedica.com postMessage events for reload and logoff actions.

Fedica sends page URL and metadata when you click its toolbar icon.

When you click the Fedica extension icon on a non-Twitter site, it reads the page URL, title, and social metadata, then sends those fields to fedica.com/browserplugin so Fedica can process the page you selected.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You click the Fedica extension icon on a non-Twitter site.

The extension did this

The extension reads the current page URL, title, and metadata, then opens a fedica.com/browserplugin request containing those values.

Captured request
GEThttps://fedica.com/browserplugin
Fields in the request
  • Current page URL
    https://example.com/article (illustrative)

    Identifies the exact page you were viewing when you clicked the extension icon.

  • Page title
    Example Article Title (illustrative)

    Provides the readable title of the page, which can describe the article or resource being viewed.

  • Page metadata
    og:title=Example Article Title (illustrative)

    Includes Open Graph or Twitter metadata such as shared titles or hashtags from the page DOM.

Updated 30 September 2026llfdnnkihahaibgllhphefhdoinkdjdf