Is XolidoSign Chrome Communication Component safe?

XolidoSign relays page messages to a local native crypto-signing component without validating the sender's origin domain.

The extension injects a content script on any URL whose path contains /chrome_ext/, where it listens for postMessage events and forwards them to the native host com.xolidosystems.cryptocomponent. The only gate is a same-window check (event.source != window), not a domain allowlist, so any website that serves a page at a /chrome_ext/ path can send arbitrary commands to the user's locally installed signing component.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.