Is keeform safe?

Question

Is keeform safe?

Accepted Answer

keeform is high risk. When you use KeeForm in a login tab, the extension can provide the stored username and password to HTTP Basic authentication challenges raised in that tab. Confirmed analysis shows the auth handler checks the tab ID rather than the challenge URL, initiator, frame, or origin, so a subresource or frame from another origin in that tab can receive credentials for the active login. When you use KeeForm to open and fill a login, the extension forwards the same plaintext username and password into each completed frame in that tab. The confirmed behavior covers credentials, form input, and the target URL, and it can reach an embedded frame instead of being limited to the login page origin.

Is KeeForm safe?

Findings