Is Stacker safe?

Question

Is Stacker safe?

Accepted Answer

Stacker is medium risk. When you open the Stacker extension popup, it fetches an HTML advertisement from a remote server (k-ext.pages.dev) and inserts it directly into the popup page using innerHTML — with no sanitization or integrity check. Any HTML the server returns, including script elements, would be executed inside the extension's privileged context. Dynamic analysis confirmed this fetch-and-inject cycle on every popup open in version 2.2.40. When you install or update the Stacker extension, it immediately contacts a remote server (k-ext.pages.dev) to retrieve a list of URLs, then opens each URL as a non-active background tab — without displaying them in the foreground or asking your permission. The list of URLs to open is entirely determined by the server's response at that moment. Dynamic analysis confirmed background tab creation on a fresh install in version 2.2.40.

Is Stacker - Falling tetra blocks! safe?

Findings