Is Todoist safe?

Question

Is Todoist safe?

Accepted Answer

Todoist is rated clean, though our review noted the following. Todoist exposes its popup page as a web-accessible resource that any website can load in an iframe. The popup registers a JavaScript message listener that accepts navigation commands from any origin without checking where they came from. When a page embeds the Todoist popup in an off-screen iframe and sends a message prefixed with 'SWITCH_URL:', the extension calls the Chrome tabs API to navigate the user's currently active browser tab to a URL supplied by the page — without any prompt or user interaction. Dynamic analysis confirmed the behavior: a test page embedding the popup and sending a crafted postMessage caused the active tab to navigate to the target URL.

Is Todoist for Chrome: Planner & Calendar safe?

Findings