Is Netflix Bilingual Subtitles safe?

Question

Accepted Answer

Netflix Bilingual Subtitles is high risk. Netflix Bilingual Subtitles injects its subtitle-overlay script directly into the netflix.com page as a real <script> tag, so it runs inside the page's own JavaScript context rather than an isolated content-script sandbox. That script listens for window.postMessage events, but unlike every other message listener the extension ships, it never checks who sent them. We confirmed with a live test that a browser window on a completely unrelated origin can post a crafted message to an open Netflix tab and have its HTML written straight into the page through innerHTML, with no sanitization -- the injected markup executed inside the Netflix page. Any website that can obtain a reference to an already-open Netflix tab, for example by opening it with window.open(), can use this to run its own JavaScript in the netflix.com origin.

Is Netflix Bilingual Subtitles safe?

Findings