Is Smart Office safe?

Smart Office relays messages from any localhost page to its native messaging host without an origin check.

Smart Office listens for messages from external web pages and, per its manifest, accepts them from any page served on localhost (any scheme or port), not just its own domains. An origin check that would have restricted this to localhost specifically is commented out in the code, so the extension forwards whatever the calling page sends, unmodified, to the local native application com.tsd.einvoice and passes the native host's response back to that page.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.