Is Medallia DXA Extension safe?

Medium risk

Medallia DXA Extension lets Medallia/Decibel pages inject a caller-supplied script into arbitrary HTTP(S) tabs.

When a Medallia or Decibel page uses the extension bridge, it can ask the extension to load a supplied script URL into another browser tab. The same bridge can also return the titles or URLs of all complete tabs when the request sets anyTab.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

Medalliav5.0.17Chrome Web Store
40Risk
Who publishes it

Medallia Inc - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Medallia
Declared legal entity
Medallia Inc
Registered address
6220 Stoneridge Mall Rd Floor 2, Pleasanton, CA 94588-3260, US
Registered contact
Mohammad Ariful Haque

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Where it sends data

Destinations our analysis observed Medallia DXA Extension contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • decibel.com

    Medallia DXA Extension sends data to decibel.com. No other extension we have analyzed sends data here.

  • decibelinsight.net

    Medallia DXA Extension sends data to decibelinsight.net. No other extension we have analyzed sends data here.

  • medallia.com

    Medallia DXA Extension sends data to medallia.com. No other extension we have analyzed sends data here.

Updated 2 November 2026iadffjigiclimjimlfcpfedjomjapnhf