Is Solventum Fluency Direct Web Connector safe?

Solventum Fluency Direct Web Connector exposes an unguarded CustomEvent bridge that lets any web page send commands to the locally-installed native host or overwrite extension storage.

The extension injects a content script into all HTTP, HTTPS, and file URLs that listens for CustomEvent messages without any origin check. Any JavaScript running on a visited page can dispatch these events to relay arbitrary messages to the com.mmodal.fluency_direct_web_connector native host or write arbitrary key-value pairs into the extension's chrome.storage.local. Overwriting stored values such as the WebSocket port or native-messaging availability flag can redirect or suppress the extension's local connections.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.