Is QR Code Reader safe?

Question

Accepted Answer

QR Code Reader is medium risk. Each time you open the QR Code Reader extension popup, it makes a network request to a developer-controlled server (dsnetx.web.app) to fetch a JSON notification configuration. The server can respond with arbitrary HTML content, which the extension renders directly in the popup via jQuery notify or a browser alert() — with no integrity check on the payload. A second fallback endpoint (dsnet.bitbucket.io) is also queried if the primary fails. Traffic analysis confirmed a live GET request to this endpoint returning an active (currently empty) config. The extension version string is included as a URL parameter, enabling the server to target specific installed versions with tailored messages.

Is QR Code Reader safe?

Findings