Is Image Downloader | Suricata safe?

The extension accepts unauthenticated postMessage image data and its popup fetches attacker-supplied URLs with the user's cookies attached.

The extension injects a content script into every page to detect downloadable images. That script listens for window messages and merges any {code:'imgs', images:[...]} payload into its image list without checking who sent it, so a malicious script running on the same page can inject arbitrary entries. When the user opens the extension's popup, it requests that image list and fetches each URL with credentials:'include', sending the site's cookies to whatever URL was supplied.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.