Critical Flaw Inward Grammarly While Checker Could Permit Attackers Pocket Your Data

H5N1 critical vulnerability discovered inwards the Chrome in addition to Firefox browser extension of the grammar-checking software Grammarly inadvertently left all 22 1000000 users' accounts, including their personal documents in addition to records, vulnerable to remote hackers.

According to Google Project Zero researcher Tavis Ormandy, who discovered the vulnerability on Feb 2, the Chrome in addition to Firefox extension of Grammarly exposed authentication tokens to all websites that could survive grabbed yesteryear remote attackers amongst only 4 lines of JavaScript code.

In other words, whatever website a Grammarly user visits could bag his/her authentication tokens, which is plenty to login into the user's trouble concern human relationship in addition to access every "documents, history, logs, in addition to all other data" without permission.

"I'm calling this a high severity bug, because it seems similar a pretty severe violation of user expectations," Ormandy said inwards a vulnerability report. "Users would non expression that visiting a website gives it permission to access documents or information they've typed into other websites."

Ormandy has besides provided a proof-of-concept (PoC) exploit, which explains how i tin easily trigger this serious põrnikas to bag Grammarly user's access token amongst only iv lines of code.

This high-severity flaw was discovered on Fri in addition to fixed early on Mon morning time yesteryear the Grammarly team, which, according to the researcher, is "a actually impressive reply time" for addressing such bugs.

Security updates are at i time available for both Chrome in addition to Firefox browser extensions, which should boot the bucket automatically updated without requiring whatever activity yesteryear Grammarly users.

H5N1 Grammarly spokesperson besides told inwards an electronic mail that the fellowship has no bear witness of users existence compromised yesteryear this vulnerability.

"Grammarly resolved a safety põrnikas reported yesteryear Google's Project Zero safety researcher, Tavis Ormandy, inside hours of its discovery. At this time, Grammarly has no bear witness that whatever user information was compromised yesteryear this issue," the spokesperson said. 

"We're continuing to monitor actively for whatever odd activity. The safety effect potentially affected text saved inwards the Grammarly Editor. This põrnikas did non deport on the Grammarly Keyboard, the Grammarly Microsoft Office add-in, or whatever text typed on websites land using the Grammarly browser extension. The põrnikas is fixed, in addition to at that topographic point is no activity required yesteryear Grammarly users."

Stay tuned for to a greater extent than updates.