The vulnerability, classified by the company as critical, can be highly useful to malicious actors considering that the Evernote Web Clipper extension has over 4.6 million users. Guardio has published a video showing how an attacker can steal a user’s Facebook information and data on PayPal transactions. The flaw in the Evernote extension allows an attacker to inject a malicious payload into all iframe contexts and steal cookies, credentials and other information. The exploit involves visiting a malicious website set up to load hidden iframes of the targeted websites. The research team at browser security firm Guardio discovered that Evernote Web Clipper for Chrome is affected by a universal cross-site scripting (XSS) vulnerability that allows malicious websites to bypass the browser’s same-origin policy (SOP) and execute arbitrary code on the victim’s behalf.Įvernote Web Clipper for Chrome is an extension that allows users to easily save webpages, articles, images, text and emails to Evernote.
A vulnerability identified by researchers in a popular Evernote extension for Chrome can be exploited by hackers to steal sensitive information from the websites accessed by a user.
0 kommentar(er)
