Is XolidoSign Chrome Communication Component safe?
XolidoSign relays page messages to a local native crypto-signing component without validating the sender's origin domain.
The extension injects a content script on any URL whose path contains /chrome_ext/, where it listens for postMessage events and forwards them to the native host com.xolidosystems.cryptocomponent. The only gate is a same-window check (event.source != window), not a domain allowlist, so any website that serves a page at a /chrome_ext/ path can send arbitrary commands to the user's locally installed signing component.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
Who publishes itXolido Systems SA - no other listings under this identity
Xolido Systems SA - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 1.2.0.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Talk to a program installed on your computer, outside the browser's sandbox
nativeMessaging