Is White Messenger safe?

White Messenger renders remote message text as raw HTML into web.skype.com and Outlook.com pages before any sanitization runs.

The extension periodically fetches a message payload from its own server, jitt.wwevents.fun, and displays it as a toast notification on Skype and Outlook web pages. The first message shown is passed straight into the page's HTML without escaping, and only a later message (reached by clicking 'next') gets run through a sanitizer. The same server also supplies a browser-notification title, body, and click-through URL, so clicking that notification opens whatever address the server included.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.