Is Momentum safe?
Momentum's site-blocker overlay can be dismissed by any web page via an unvalidated postMessage.
Momentum registers a content script on all URLs that displays a blocking overlay when a user visits a restricted site. The overlay listens for postMessage events with the value 'momentum-intervention:dismiss' but does not check the origin of the sender. Any web page — including the blocked site itself — can send this message to immediately close the overlay and regain access.
Who publishes itMomentum Dashboard - no other listings under this identity, 1 shared hostname
Momentum Dashboard - no other listings under this identity, 1 shared hostname
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.