Is Signer.Digital Digital Signature, PKI safe?

Signer.Digital exposes a postMessage bridge on every page that any website can use to relay commands to a local native PKI host.

The extension injects a script into all pages that exposes a window.SignerDigital API, allowing any website to call methods that retrieve smart card certificate details including name, email, organisation, and thumbprint. Content scripts relay postMessage events to the background page, which forwards them without filtering to the native host signer.digital.chrome.host. Because the only gate is a constant string (src: 'user_page.js') that ships inside the extension's web-accessible resources, any page can craft matching messages and invoke arbitrary native messaging commands.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.