Is Synology Image Assistant Extension safe?
Synology Image Assistant Extension accepts postMessage commands from any webpage, enabling relay to the local Synology desktop client.
The extension's content script, active on all websites, listens for postMessage events without validating the sender's origin. Any webpage can send an INIT_PORT message using the publicly readable message type constant to establish a communication channel. Once connected, the page can instruct the extension to fetch attacker-controlled URLs or forward data to the native Synology desktop application via native messaging.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 1.0.33. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Store data in your browser
storage
Talk to a program installed on your computer, outside the browser's sandbox
nativeMessaging
Where it sends data
Destinations our analysis observed Synology Image Assistant Extension contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- com.synology.extension.host
Synology Image Assistant Extension sends data to com.synology.extension.host. No other extension we have analyzed sends data here.