Is mdpi_home safe?

Question

Is mdpi_home safe?

Accepted Answer

mdpi_home is medium risk. When you sign in to MDPI Home, the extension posts your credentials to home.mdpi.cn/login and stores the returned login token as a cookie. That cookie is set for http://home.mdpi.cn without Secure or HttpOnly protection, which can expose the token in browser cookie storage and non-HTTPS requests. When you are logged in, the extension fetches your MDPI notification list and forwards the notification title and content to the active tab once per minute. Those notification details are rendered into an open shadow DOM on the website you are viewing, where page scripts on that origin can read the rendered text.

Is mdpi_home safe?

Findings