Is Kiosk Extension safe?

Kiosk Extension writes its plaintext admin unlock password into a visible page element, readable without logging in.

The settings page populates a hidden admin_pass input with the plaintext password from extension storage as soon as the settings form loads, before the login prompt is passed. Because the login check only compares typed text against that same stored value, anyone who inspects the page's DOM or uses the browser's developer tools can read the password directly and bypass the kiosk lock without ever entering the correct credentials.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.