evernote web clipper problems chrome 2019

Guardio also praised Evernote for its quick response time following the disclosure of the vulnerability – initial disclosure was made on May 27 and a fix was released in ‘record time’, just four days later.Įvernote is an application that allows users to take and organize notes across multiple platforms, utilized by millions.

“All it takes is a single unsafe extension to compromise anything possible for you to do online (financials, social media, personal emails, and more).”

“This vulnerability is a testament to the importance of treating browser extensions with extra care and only installing extensions from trusted sources,” wrote the Guardio Research Team in a blog post. The vulnerability has been assigned as CVE-2019-12592.Įvernote Web Clipper for Chrome has been downloaded more than 4.6 million times, according to statistics provided by the Chrome Web Store.Ī fix has since been issued and users are advised to update to the latest version of the extension, 7.1.11.1 or above. “In contrast to most critical extension vulnerabilities in the past, such as the infamous Grammarly security bug, this vulnerability directly impacts third-party services and is not limited to a person’s Evernote account.” “Upon successful exploitation, a visit to a hacker-controlled website would compromise the visitor’s private data from affected third-party websites,” Guardio said.

This meant that an attacker could execute code on behalf of the user and be granted access to their personal data said researchers at Guardio, a cybersecurity technology firm. The Evernote Web Clipper was found to be exploitable by a cross-site scripting ( XSS) attack due to an error that could allow a malicious actor to bypass Chrome’s same-origin policy. UPDATED Millions of users’ private information was at risk of a critical vulnerability in an extension for the popular content organizer Evernote, researchers have warned.

Evernote web clipper problems chrome 2019