Is Microsoft Single Sign On safe?

Question

Accepted Answer

Microsoft Single Sign On is medium risk. The Microsoft Single Sign On extension injects a content script into every HTTPS page your browser loads. That script listens for window.postMessage events and forwards matching requests to the Windows Web Authentication Manager (WAM) native bridge, which handles Entra ID and Azure AD sign-in without user prompts. The only caller-side gate is a fixed channel UUID that is visible in the published extension bundle—any JavaScript running on any HTTPS page can use that UUID to address the relay. Dynamic analysis confirmed that an arbitrary HTTPS page received a HandshakeResponse from the extension, proving the relay accepts requests without checking the caller's origin. The native bridge receives the page origin forwarded by the background script and is expected to enforce its own allowlist; the extension itself applies no origin restriction.

Is Microsoft Single Sign On safe?

Findings