Is PingOne-Extension safe?
PingOne-Extension injects autofill scripts into all pages and accepts postMessages without origin validation to trigger form fills.
The extension runs on every website and uses postMessage listeners to coordinate its SSO autofill workflow across frames. Both the init.js content script and the injected extension.js handle inbound messages without checking the sender's origin, meaning any same-page script or cross-frame message can trigger script injection or instruct the autofill engine to fill form fields with attacker-supplied values and selectors. The autofill machinery (simulateEnterInputValue) processes field selectors and values directly from the message payload.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
Who publishes itPing Identity Corporation - no other listings under this identity
Ping Identity Corporation - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 2.59.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
Store data in your browser
storage
Run its own code inside the pages you visit
scripting
See the address and title of every tab you have open
tabs