acorn221

TL;DR. SConnect - 1M+ users, an extension middleware+native host for authentication with eIDs, 3SKeys and other hardware signing tokens had a drive-by RCE which enabled any site or iframe a user saw to silently download and execute a dll due to a poor hand-rolled implementation of RSA-2048 token validation, enabling a use of uninitialized memory validation bypass which enabled "plugins" (DLLs) to be loaded. v2.16.0.0 of the extension and native host is vulnerable. CVE-2026-18397. CVSS 9.4.

Damn Rory, I didn't know you wrote fiction! Nice work here

The only numbers I've got right now are the 2M+ weekly active users on the chrome web store listing - I've not got exact numbers for how many people use the card readers but I get the impression it's more common in the legacy enterprise/government world.

The 2M+ WAUs would still be vulnerable to the RCE (assuming the native host is setup) independent of whether or not they have a card reader.

Thanks! ItsMe actually uses the connective signing ext system to sign users up so it's likely lots of people signed up for itsme with this flow and just never uninstalled the extension and native host.

The thumbnail is ai generated, the content is not. I'm OP here. I can't afford artists to draw all the thumbnails and I'm not going to refrain from using all the tools at my disposal.

First DEF CON, first conference talk and I loved it.

This is my extension, I made it because I hate the UX of PGP.

It uses passkeys (or passwords) to encrypt all keys (public and private) at rest so your contacts can't get leaked easily.

I do a bunch of vulnerability research with sensitive info and I hated having to go to the CLI every time I wanted to encrypt a new message. I found myself getting lazy and not encrypting messages.

Uses SequoiaPGP via WASM in rust, private keys only persist in ram when they are being used (or you can choose to cache them) and it doesn't let the JS hold the pvivate keys where garbage collection can persist them longer than needed - it zeroizes wherever private keys are being used.

https://github.com/Am-I-Being-Pwned/PGP-Tools

ik lol, I was too lazy to change it

I thought I’d check to see whether or not they actually read what they were adding lol

If you want to go check for it, open linkedin on Chrome, open dev tools -> network tab -> magnifying glass at the top then search for "epstein" and you'll see it!

Yeah I mean it's not very commonly used by extensions. I quite like it as it's completely isolated and not detectable. I built my first extension which uses it as the primary interface yesterday: https://github.com/Am-I-Being-Pwned/PGP-Tools

Yeah I agree. All new extensions should have this for their web_accessible_resources.

With that said, the chrome web store ecosystem has bigger problems infront of them. For example, loads of extensions outright just send every URL you visit (inc query params) over to their servers. Things like this just shouldn't happen, imagine you installed an extension from a few years back and you forgot about it, that's what happened to me with WhatRuns, which also scraped my AI chats.

I'm working on a tool to let people scan their extensions (https://amibeingpwned.com/) and I've found some utterly outrageous vulnerabilities, widespread affiliate fraud and widespread tracking.

Yeah, this is the easiest way to get around it

So these extensions allow linkedin to do this though, it's literally them saying "yes, this site can ping this resource" - called "web_accessible_resources".

This is fair from Linkedin IMO as I've seen loads of different extensions actually scraping the linkedin session tokens or content on linkedin.

They have! It's these developers either not knowing or not caring about it which is the issue! I did a blog post about this a while back showing how they do it, and how you can get around it, it's not very complex for the devs.

https://www.linkedin.com/pulse/how-linkedin-knows-which-chro...

Yeah I agree

This gave someone the opportunity to add in "Jeffery_Epstein_did_not_kill_himself" to linkedin's client facing code base through this. If you open dev tools -> network tab -> network search icon (magnifying glass) -> search for "epstein" and load up linkedin, you should see it for yourself too!

I really don't think they're "illegally" searching your computer, they're checking for sloppy extensions that let linkedin know they're there because of bad design.

Bold claim, I know.

It's opensource, has better UX and fewer requested permissions than every other PGP extension IMO. It uses passkeys as the primary flow (but you can use passwords) to fully E2EE your secrets. You can choose the synced storage (syncs between devices and touches google's servers) or you can just keep everything local.

There are no calls to external services like analytics or any of my own servers. The Crypto side of this is based off of SequoiaPGP, compiled to WASM.

It lets you drag & drop files, lets you add in text and just saves time.

I made this because I personally wanted it, I had to encrypt my vulnerability reports (which put me on the Center for Cyber Security Belgium Wall of Fame https://ccb.belgium.be/cert/vulnerability-reporting-ccb/wall...)

Going between the console and my email was a pain, and there were no other easy solutions so I decided to make one.

If you want to go browse the code or submit issues/PRs, feel free: https://github.com/Am-I-Being-Pwned/PGP-Tools

I am OP here, feel free to ask questions!