Is ONTO Wallet safe?

ONTO Wallet forwards wallet RPC requests from page frames to the extension as the top-level site.

ONTO Wallet injects a content script on web pages that forwards wallet RPC messages from the page to the extension background process. The bridge does not check the message origin or require the message to come from the top window, so a frame inside an already connected site can trigger account access and signing or transaction approval flows as that site.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.