evernote web clipper chrome restrictions

Understanding the vulnerability first requires basic understanding of how Evernote Web Clipper for Chrome interacts with websites and frames.Įvernote’s code injection chain starts with the extension’s manifest (manifest.json) where the BrowserFrameLoader.js content script injected declaratively into all pages and frames. Injected payload is customized for each targeted website, able to steal cookies, credentials, private information, perform actions as the user and more.The exploit is triggered by the malicious website and causes Evernote’s internal infrastructure to inject an attacker controlled payload into all iframes contexts.Malicious website silently loads hidden, legitimate iframe tags (link) of targeted websites.via social media, email, a compromised blog comment, etc.). User navigates to the attacker’s malicious website (e.g.By chaining together several steps, It is simple to see the alarming repercussions. To simulate how an attacker might exploit the vulnerability, Guardio has devised a Proof-of-Concept (PoC) able to steal sensitive data from an unsuspecting user. In contrast to most critical extension vulnerabilities in the past, such as the infamous Grammarly security bug, this vulnerability directly impacts third party services and is not limited to a person’s Evernote account.

Due to Evernote’s widespread popularity, this issue has the potential of affecting an unusually large amount of consumers and (over 4,600,000 users at the time of writing). While the app author’s intent is to provide better user experience, extensions usually have permissions to access a trove of sensitive resources and pose a much greater security risk than traditional websites.Īs part of Guardio’s ongoing security analysis efforts, our researchers have discovered a critical vulnerability in Evernote Web Clipper for Chrome. Some tools need additional access and permissions in order to better perform their tasks, to which the solution is creating a browser extension. In addition to social accounts, shopping and financials, It is becoming more and more common to find the best software tools provided directly in the browser. The majority of internet users do not download executables or install specialized software.

4.6/5 based on 1,000+ Trustpilot reviews Background

Evernote web clipper chrome restrictions