Is Omnidoc safe?

Omnidoc relays commands from omnidoc.fr pages to a local native host without a command allowlist.

The extension installs a content script on omnidoc.fr pages that listens for postMessage calls and forwards them to the background service worker. The background worker passes the full message payload directly to the native host fr.omnidoc.local_services, which handles local medical device operations such as reading a Vitale card. Because no command allowlist is applied before forwarding, any command accepted by the native host can be triggered by omnidoc.fr page content.