Is Signer.Digital safe?

Question

Accepted Answer

Signer.Digital is medium risk. The extension's content script forwards postMessage commands from any webpage directly to the locally installed signer.digital.chrome.host native application. The only dispatch check — that the message carries a src field equal to 'user_page.js' — uses a string constant that is publicly readable from sdscript.js, which the extension declares as a web_accessible_resource available to every page. Any page that reads or knows this string can craft messages that get forwarded verbatim to the native host: commands to enumerate smartcard readers, retrieve certificate details, query the host version, and more. This relay chain was confirmed during dynamic analysis: a page script on a third-party page posting the message triggered background.js and the relay to the native host. The extension injects a JavaScript object called window.SignerDigital into every webpage you visit. Any script on those pages can call getSCDetailsAndCerts() to retrieve the name, email address, organization, and thumbprint from your connected smartcard or USB token — no license check, no consent prompt. Dynamic analysis confirmed the API is present and callable on arbitrary pages: calling getSCDetailsAndCerts() from a third-party page context returned certificate identity data directly to the calling script.

Is Signer.Digital Digital Signature, PKI safe?

Findings