evernote extension problems on chrome 2019

The logical coding error in the Web Clipper extension could have allowed an attacker to bypass the browser's same origin policy, granting the attacker code execution privileges in Iframes beyond Evernote's domain. Guardio disclosed the vulnerabilities to Evernote during the last week of May, which prompted Evernote to address them and roll out a complete fix - within less than a week.ĭue to Evernote's widespread popularity, this issue had the potential of affecting its consumers and companies who use the extension – about 4,600,000 users at the time of discovery.

The vulnerability, a Universal XSS marked CVE-2019-12592, was discovered as part of Guardio's ongoing security analysis efforts using a combination of internal technology and researchers.

TEL AVIV, Israel, J/PRNewswire/ - Guardio, a leading browser-centric and cloud security company, discovered a major flaw in Evernote's Web Clipper Chrome extension's code that left it vulnerable, potentially allowing threat actors to access personal information from users' online services.

Evernote extension problems on chrome 2019