Am I Being Pwned? logoAm I Being Pwned?
Book a demo
HomeRaycast Companion
Findings · 3
+1 more finding locked
HIGH FINDINGS · 3
  1. 01Localhost JSON-RPC channel has no authentication, no origin/peer verification, and no token handshake — any local process that binds ws://localhost:7263-7266 before Raycast.app does can drive getHistory, executeJS and elementFill via the extension.
  2. 02Service worker opens WebSocket to ws://localhost:{7263,7264,7265,7266} and exposes JSON-RPC methods (incl. getHistory, getBookmarks, executeJS, elementFill) to whatever process is bound on those ports — primary disclosed function ('give more context to Raycast').
  3. 03Service worker registers a USER_SCRIPT world (userScripts.js) on all URLs with CSP 'script-src self unsafe-eval' that performs `eval(req.body.script)` on whatever payload arrives via the executeJS RPC method.
+1 more finding locked
OTHER EXTENSIONS

Is Raycast Companion safe?

High risk

No summary available.

Raycast Technologiesv1.2.2Chrome Web Store
75Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

+1 more finding not shown

Book a call to see all findingsScan your browser
Updated 30 May 2026com.raycast.safari-extension.extension

Am I Being Pwned?

Protecting organizations from malicious browser extensions.

© 2026 Bay Area Labs Inc. All rights reserved.

BlogHow it worksSecurityFor VendorsFAQAPI DocsPrivacy PolicyTerms of ServiceContact