Is Google Images Restored safe?

Google Images Restored accepts window messages from any page with no origin check, letting an attacker replace the full-size image link.

The extension restores the old Google Images layout and, when a user clicks a thumbnail, resolves the full-size image URL through a page-level postMessage handler that does not check the sender's origin. A malicious page holding a reference to the tab can send a forged message that wins a timing race and gets treated as the resolved image, so the 'view full size' link and preview can point to a URL the attacker chose instead of a Google-hosted image.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.