Is Open in IE safe?

Open in IE exposes a shared DOM channel that any webpage can use to open an attacker-chosen URL in Internet Explorer.

The extension injects two content scripts into every webpage to relay user clicks to a native IE launcher. Page-context JavaScript can dispatch a CustomEvent on the extension's shared DOM element to supply an arbitrary URL; the content scripts forward this to the background worker, which calls chrome.runtime.sendNativeMessage to launch iexplore.exe with that URL on Windows. The native messaging host is the extension vendor's own app (com.add0n.node), so no data leaves to third-party servers.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.