Is Whatfix For Google safe?

Whatfix For Google accepts window messages without checking origin and can be made to fetch caller-chosen URLs and screenshot the tab.

On every google.com page, a content script listens for window postMessage events without verifying the sender's origin, and forwards a matching command string into the background service worker's internal message handlers. Two of those handlers are privileged: one makes the background worker POST an attacker-supplied URL with attacker-supplied headers and returns the response, and the other captures a screenshot of the visible tab and returns it as an image. Any script able to post a message into a matched frame can reach these actions.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.