Is Fonts Ninja safe?

Question

Accepted Answer

Fonts Ninja is high risk. Dynamic analysis confirmed that any web page can send a postMessage to the Fonts Ninja content script to trigger arbitrary HTTP requests from the extension's background service worker, bypassing cross-origin resource sharing (CORS) restrictions. The extension's content script is injected on every http:// and https:// page and forwards postMessage events with no validation of the message origin. Because the extension holds host_permissions for all URLs, requests made this way reach any server that the requesting page itself would be blocked from by CORS policy. A test request sent from an unrelated origin was observed to cause the extension to fetch an arbitrary external URL and return the full response body to the requesting page. Dynamic analysis confirmed that any web page can read the authentication token stored by Fonts Ninja in chrome.storage.sync by sending an unauthenticated postMessage. The extension's content script is injected on every http:// and https:// page and responds to get_storage postMessage commands without checking the origin of the request. A planted marker value was transmitted back to the requesting page, confirming that the extension returns its stored 'persist:auth' value — which includes the user's JWT (containing their email address) and device identifier — to any page origin. Any website the user visits while logged in to Fonts Ninja can receive these credentials without any notification.

Is Fonts Ninja safe?

Findings