Is News Hub kiosk safe?

News Hub kiosk renders operator-controlled remote message text into the page as raw HTML before any sanitization runs.

The extension periodically fetches message strings from jitt.wwevents.fun and displays them as toast notifications on BuzzFeed, Tasty, Google News, and MSN pages. The first time a message is shown it is inserted directly into the page's HTML without sanitization; only a later, user-triggered 'next message' click applies sanitization to the same content. Separately, the background service worker polls the same server for desktop notifications whose title, message, icon, and click-through destination URL are all set by the remote endpoint.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.