Is TrustPlugin safe?
TrustPlugin relays web page signing and certificate requests to a local native host, with no check on the requesting site.
On every site, the extension's content script accepts messages posted by the page and forwards them to a native application on the computer (firefox.trust.plugin), adding the page's hostname. Any website can therefore submit certificate and signing requests, and the native host, which is not part of the extension, decides whether to act on them. The extension can also fetch certificate files from page-supplied URLs.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 1.4.0.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
See the address and title of every tab you have open
tabs
Schedule its own background tasks
alarms
Store data in your browser
storage
Talk to a program installed on your computer, outside the browser's sandbox
nativeMessaging
Show you desktop notifications
notifications
Run its own code inside the pages you visit
scripting
Act on the current tab, but only after you click the extension
activeTab
Where it sends data
Destinations our analysis observed TrustPlugin contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- firefox.trust.plugin (local native host)
TrustPlugin sends data to firefox.trust.plugin (local native host). Named as a recipient in this extension's own analysis.