Is Orbital Daggers safe?
Orbital Daggers injects server-controlled HTML into its popup from fn.onionfist.com and exposes extension storage to onionfist.com pages.
Each time the extension popup opens, it retrieves a JSON payload from fn.onionfist.com and inserts the included HTML directly into the popup DOM, allowing the remote server to control what users see inside the extension. The extension also grants any page on onionfist.com the ability to read, write, overwrite, or completely clear the extension's local storage via externally_connectable message handlers—with no validation on the incoming data.
Who publishes itOnionfist Studio - 1 other listing from the same operator, none carrying a finding
Onionfist Studio - 1 other listing from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 400k+ users between them, none of them carrying a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Extension popup loads server-supplied HTML into its DOM on every open
Opening the Orbital Daggers popup fetches JSON from fn.onionfist.com and injects the HTML into the popup's DOM via jQuery; content can include iframes, forms, images.
A changed response shows up unprompted.
MV3 blocks inline scripts.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
You open the Orbital Daggers extension popup.
No interaction beyond clicking the toolbar icon is required.
The popup fetches a JSON payload from fn.onionfist.com and writes the response's HTML field directly into the popup page.
jQuery's.html() is used, so the server can supply any HTML element, iframes, images, styled forms, anchor tags, that the browser will render inside the extension's privileged popup context.
JSON object with an 'html' key; the value is a markup string that jQuery inserts into the #news div in the popup DOM.
Remote HTML fetch and DOM injection in the popup script
var news = { init: function() { this.get_news(function(data) { console.log(data); if (data != null) { if (data.html != null) { $("#news").html(data.html); // line 1511: server HTML → popup DOM } } }); }, get_news: function(callback) { try { // https://developer.chrome.com/docs/extensions/mv3/xhr/ fetch("https://fn.onionfist.com/chrx_news?chrx=orbdag").then(function(res) { if (res.status !== 200) { callback(null); } res.json().then(data => { callback(data); }); }); } catch(err) { console.log("News err", err.message); callback(null); } }};- fn.onionfist.com
Serves JSON with an HTML string injected verbatim into the popup DOM on every open. This host's operator controls what HTML all active users see.
MV3's content-security policy prevents inline `<script>` tags and `javascript:` hrefs from executing inside the popup, so the server cannot run arbitrary JavaScript in this context. The confirmed impact is HTML and CSS injection: the server can render iframes (including cross-origin frames), images with tracking pixels, styled overlays that obscure the popup's legitimate UI, and clickable links. Exploitation requires either the server being compromised or the operator choosing to serve attacker-controlled markup.
What it can do
Permissions this extension asks for, as declared in version 0.012. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Store data in your browser
storage
Where it sends data
Destinations our analysis observed Orbital Daggers contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- fn.onionfist.com
Orbital Daggers sends data to fn.onionfist.com. No other extension we have analysed sends data here.
- onionfist.com
Orbital Daggers sends data to onionfist.com. No other extension we have analysed sends data here.