Is feedly safe?

Low risk

Feedly's mini widget accepts postMessage commands from any origin whose string merely contains "feedly.com".

On every http:// page, Feedly injects a mini widget that listens for postMessage commands and checks the sender's origin with a substring match instead of an exact comparison. A page hosted anywhere containing the text "feedly.com" in its origin (for example a subdomain the page owner controls) can pass this check and trigger the widget to force-open Feedly tabs or resize its popup. No user data is read or transmitted by this behavior.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

Feedlyv35Chrome Web Store
20Risk
Who publishes it

Feedly - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Feedly
Declared legal entity
Feedly
Registered address
805 Veterans Blvd Ste 220, Redwood City, CA 94063-1736, US
Registered contact
Edwin Khodabakchian
Website
www.getsatisfaction.com/feedly

Same store account

1 other listing published from this account, 100k+ users between them, none of them carrying a finding.

Feedly Mini100k+Clean

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

gizmodo.com
Also called by 3 other listings, including JustBlock Security – Ad Blocker, Malware & Phishing Protection

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 35. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on google.com

    https://*.google.com/

  • Read and change your data on twitter.com

    https://*.twitter.com/

  • Read and change your data on graph.facebook.com

    https://graph.facebook.com/

  • Read and change your data on www.google.com

    https://www.google.com/reader/* and 1 more

  • Read and change your data on www.googleapis.com

    https://www.googleapis.com/oauth2/*

  • Read and change your data on www.facebook.com

    https://www.facebook.com/plugins/like.php*

  • Read and change your data on every site you visit

    http://*/*

  • Keep running in the background while your browser is open

    background

Updated 30 September 2026hipbfijinpcgfogaopmgehiegacbhmob