Is Horizon HTML5 Redirection safe?

Question

Accepted Answer

Horizon HTML5 Redirection is medium risk. The Horizon HTML5 Redirection Extension injects a WebSocket relay into every web page and frame you visit. Any script running on the page — including third-party content or scripts placed through a cross-site scripting attack — can instruct the extension to open a WebSocket connection to any server. The only gate is a hard-coded group key that is visible in the public extension bundle; no shared credential or host allowlist applies. Dynamic analysis confirmed: sending the trigger message from a test page caused the extension to open a WebSocket connection to an external server.

Is Horizon HTML5 Redirection Extension safe?

Findings