Is 2C Health Solutions safe?
We analyzed 2C Health Solutions version 3.9.15's actual code and gave it a 18/100 trust score. 2C Health Solutions has serious security weaknesses even…
Bottom line
2C Health Solutions has serious security weaknesses even though its healthcare access largely fits its stated purpose.
What it can access
It requests storage and web-navigation access and injects its main healthcare code and frame hook into every HTTP/HTTPS page; many EHR-specific scripts add further targeted access. [Q1]
Security weaknesses
Any website can obtain its stored 2C login information. [Q14][Q21] Its server can also send new page instructions that run without a store update. [Q7][Q16]
Signs of misuse
No clear signs of misuse were found in the reviewed package. [Q11][Q20]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests storage and web-navigation access and injects its main healthcare code and frame hook into every HTTP/HTTPS page; many EHR-specific scripts add further targeted access.
Declares webNavigation/storage and includes *://*/* in both the all-frame hook and main integration content-script matches. — manifest.json:8-10,26-129
Which websites can it run on, and can it read or change what appears on those pages?
It reads patient and appointment information from supported EHR pages. An all-frame XPath hook can also extract text selected by a supplied XPath.
Reads patient name, date of birth, record ID, phone and gender from an EHR page. — assets/js/Emr/emedpractice.js:18-48
Accepts an XPath message, extracts matching text and posts results to the top window. — assets/js/scheduleFrameHook.js:226-311
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It processes highly sensitive healthcare data including patient identity, date of birth, record ID, contact details, schedules, diagnoses, medications and clinical notes.
Defines patient name, DOB, EMR ID, email, phone and address fields. — assets/js/dataStore.js:1-10
Accepts patient/clinical data and stores patient identity and contact details in the integration state. — assets/js/contentScript.js:1338-1357,1440-1452
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Declares webNavigation and storage, not history, bookmarks, cookies or downloads. — manifest.json:8-10
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
The telemedicine feature enables camera and microphone access inside its packaged frame. Browser permission prompts and user initiation remain safeguards.
Creates healthcare frames with camera/microphone/geolocation permissions, including the packaged telemedicine view. — assets/js/contentScript.js:1130-1139,1313-1326
Packaged WebRTC library contains local-media acquisition and peer-stream logic. — assets/TwoCEmbed/telemedicine/webrtc/RTCMultiConnection.min.js:15
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends patient and schedule data to the authenticated 2C service for the advertised workflow. Separately, the message flaw can send the stored login object to an attacker iframe.
Searches patients and submits extracted schedule text through authenticated 2C API services. — assets/js/contentScript.js:973-1013,1281-1305
Sends stored securityData to whichever frame currently has id twocAppModalIframe. — assets/js/contentScript.js:1426-1437
Does it download or run code, settings, or instructions supplied by a remote server?
The 2C services remotely decides which domains are approved, supplies schedule XPath rules and can return a JavaScript string for execution on the page.
Uses ExtClients/GetExtClientByDomain response fields for domain approval, scheduleXPath and executable contentScript. — assets/js/contentScript.js:1610-1655
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Every page automatically performs an authenticated domain-verification request while the user is logged in. Patient searches and most clinical actions follow supported-page or user interactions.
Calls VerifyDomainname on document ready and sends the current hostname to the 2C API. — assets/js/contentScript.js:682-815,1610-1665
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no browser-settings, proxy or management permission. — manifest.json:8-10
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The package includes large minified Angular, jQuery, WebRTC, SignalR and PubNub bundles, while key integration code is readable. Minification alone is not treated as abuse.
Loads minified third-party libraries plus readable service and content-script files. — manifest.json:109-128
The packaged Angular application is bundled onto one minified line. — main-es2015.9022a78f57ff1527843b.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Receives resultData.contentScript, assigns it to documentElement.onreset and dispatches reset. — assets/js/contentScript.js:1610-1655
Does it track the websites, pages, searches, or links you visit?
While logged in, it sends every visited hostname to the 2C services for domain verification. It does not send the full unrelated page path in this flow.
Uses window.location.host as the searchText query in an authenticated API call. — assets/js/contentScript.js:1616-1622
The calling content script runs on *://*/* pages. — manifest.json:70-129
Does it create a persistent ID or browser fingerprint to recognize you?
Domain-verification requests carry the user's bearer token, so the 2C service can associate visited hostnames with the logged-in account. No separate advertising identifier was found.
Reads the stored bearer token and adds it to each API request. — assets/js/httpService.js:40-49,127-135,309-344
Submits the current hostname through that authenticated service. — assets/js/contentScript.js:1616-1622
Does it send cookies, session details, authentication data, or page contents elsewhere?
A malicious webpage can obtain the stored access token, refresh token and account claims by creating a named iframe and sending one window message. No origin, source, approved-domain or user-consent check blocks the path.
The vulnerable content script runs on every website. — manifest.json:70-129
Accepts OnRequestLoginData from any window message, reads securityData and posts it with wildcard targetOrigin to the frame selected only by DOM id. — assets/js/contentScript.js:682-684,1332-1437
The stored security object includes bearerToken, refreshToken, identity, claims, baseUrl and appUrl. — main-es2015.9022a78f57ff1527843b.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Uses specific patient selectors rather than global keyboard or form listeners. — assets/js/Emr/emedpractice.js:18-48
Registers extension UI click handlers but no document-wide key capture or screenshot API. — assets/js/contentScript.js:682-815
Can a website or remote server send commands that make the extension take actions?
The 2C server can enable the integration for a hostname, choose the schedule XPath and supply page-context JavaScript. Login and server domain approval are the only observed gates; there is no per-data prompt or code allowlist.
Authenticated API response directly controls domainVerifiedByTwoC, scheduleXPath and executed contentScript. — assets/js/contentScript.js:1610-1655
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Appends the packaged 2C interface to the page after domain verification. — assets/js/contentScript.js:949-971
Executes server-supplied code in the page context. — assets/js/contentScript.js:1610-1655
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Builds authenticated requests from stored baseUrl and bearerToken. — assets/js/httpService.js:23-45,118-135,309-344
Implements packaged real-time patient/service messaging behavior. — assets/js/pubnubService.js:1-232
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging or system-level permission. — manifest.json:8-14
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Fetches remote domain configuration and executes its contentScript field through an event-handler attribute. — assets/js/contentScript.js:1621-1655
Can ordinary websites access privileged extension features through messaging or exposed files?
The all-site window-message bridge is unrestricted. Any page can request the stored login object and direct the wildcard reply to an attacker-controlled iframe.
Message handler has no event.origin/source validation and replies with securityData to a DOM-selected frame using '*'. — assets/js/contentScript.js:682-684,1332-1437
Loads the bridge on all HTTP/HTTPS pages. — manifest.json:70-129
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Behavior depends on login state, facility settings and live server configuration. The most dangerous remote-code path is active only when logged in and the server approves the current domain, but the token-disclosure bridge remains reachable on every site while credentials are stored.
Loads stored security state and asks the API to approve/configure each hostname. — assets/js/contentScript.js:796-815,1610-1665
Login-data handler itself does not check domainVerifiedByTwoC. — assets/js/contentScript.js:1332-1437
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Implements healthcare integration, patient workflows and UI behavior without mining logic. — assets/js/contentScript.js:1-2070
Does it change form fields or where a form sends its information?
It deliberately fills clinical-note and billing-code fields on supported EHR pages. This supports the advertised workflow, but server-supplied page code could also alter forms without a packaged field allowlist.
Writes a session note into an editor iframe and fills CPT code/unit inputs, then dispatches input/change events. — assets/js/contentScript.js:1912-1949,1952-2041
Executes server-supplied code that can access the approved page context. — assets/js/contentScript.js:1610-1655