Is Lock safe?

Question

Is Lock safe?

Accepted Answer

Lock is critical risk. Our dynamic analysis confirmed that the extension's content script accepts postMessage commands to create and insert HTML elements into the current page's DOM. Any sender — including the modal.style iframe the extension injects — can specify the tag name, attributes, styles, inner content, and parent selector for the new element. We observed the browser fetching an external script URL provided in the injected element's src attribute, confirming that the path enables arbitrary script execution on any page. Our dynamic analysis confirmed that the extension injects a non-visible iframe pointing to modal.style/load into every web page you visit, but only after 8 or more hours have passed since installation. The delay makes the behavior harder to observe during initial testing. Once active, the iframe from modal.style is present on every page and is used to send commands back to the content script. 1 further issue was flagged.

Is Lock Adblock safe?

Findings