Is Join safe?

Join dispatches remote-control commands received via push notification through eval() with no signature check.

Join lets you control this device from your other devices (opening URLs, taking screenshots, reading the clipboard, sending SMS, and more) by listening for push messages from Google's GCM/FCM service and its own backend, joinjoaomgcd.appspot.com. When a push message arrives, the extension resolves the requested command class by name using eval() and runs it immediately, without verifying any signature on the message itself — it relies only on the push message having been delivered to this device's registration token.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.