Is MPCVault safe?

MPCVault lets any webpage set the extension's stored login token through its injected login bridge.

MPCVault injects a provider script into every webpage and forwards its login event from the page into the extension. If a page supplies an allowed login payload with a token, the service worker stores that token in extension storage and starts the login flow without limiting the message to MPCVault's console site.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.