Is Topaz SigPlusExtLite safe?

Question

Accepted Answer

Topaz SigPlusExtLite is medium risk. Dynamic analysis confirmed that any website can cause the Topaz SigPlusExtLite extension to activate an attached Topaz hardware signature pad and return the captured biometric signature data to the requesting page. The extension's content script runs at document start on every HTTP and HTTPS page you visit and registers CustomEvent listeners—including SignStartEvent—on the page document without checking which origin dispatched the event. A signing command dispatched from example.com was relayed through the extension's service worker, which immediately opened a native-messaging connection to the Topaz host (com.topaz.sigplusextlite.win.2). The extension also exposes its full JavaScript signing API (SigPlusExtLiteWrapper.js) as a web-accessible resource reachable from all URLs, so any page can load and invoke the complete signing API surface. A page that triggers a successful signature capture receives the signature image (PNG), raw pen stroke data, and sigString in response.

Is Topaz SigPlusExtLite Extension safe?

Findings