A Bug in Browser Extension Grammarly, Now Patched, Could Have Allowed an Attacker To Read Everything Users Wrote Online (gizmodo.com)

Copyediting app Grammarly included a gaping security hole that left users of its browser extension open to more embarrassment than just misspelled words. From a report: The Grammarly browser extension for Chrome and Firefox contained a "high severity bug" that was leaking authentication tokens, according to a bug report by Tavis Ormandy, a security researcher with Google's Project Zero. This meant that any website a Grammarly user visited could access the user's "documents, history, logs, and all other data," according to Ormandy. Grammarly provides automated copyediting for virtually anything you type into a browser that has the extension enabled, from blogs to tweets to emails to your attorney. In other words, there is an unfathomable number of scenarios in which this kind of major vulnerability could result in disastrous real-world consequences. Grammarly has approximately 22 million users, according to Ormandy, and the company told Gizmodo in an email that it "has no evidence that any user information was compromised" by the security hole. "We're continuing to monitor actively for any unusual activity," a Grammarly spokesperson said.

Comments

Wasn't WebExtensions supposed to protect us?!

[Anonymous Coward]

Firefox recently switched to the WebExtensions model for browser extensions, which is basically Firefox's imitation of Chrome's extension system.

Firefox 57, which was released in the middle of November 2017, was hugely disruptive. It broke nearly all of Firefox's existing extensions, and worst of all, there are some existing extensions that couldn't even be reimplemented properly because WebExtensions is so crippled and limited.

The crippling of Firefox's extension system, which rendered Firefox nearly useless for many power users, was justified by saying that it made Firefox's users "safer". Of course, many sensible Firefox users were skeptical of these claims.

I think that this incident just goes to show that the Firefox users who questioned the security claims being made about WebExtensions were absolutely correct.

So now Firefox is not only crippled and much less useful than it was just a few months ago, but we haven't even realized any security gains from the switch over to the extension system that imitates Chrome's approach.

The Firefox 57 debacle was already bad enough, but this incident makes it even worse than it already was, I think.

Re:seems like a feature

[CastrTroy]

This is basically a symptom of a problem that exists everywhere. Most people can learn how to program. In school they teach you how to program. But it's an entirely other type of skill to program something that can't be broken by malicious actors. Most people learn how to code in a very safe environment, and don't ever have their code attacked or challenged until much later into their career. It's hard enough for most companies to find developers that will check user input (does this number field actually contain a number), never mind checking for users who are actively trying to attack the system.

It's kind of a problem that's only found in the computer industry. Cars don't stop people from crashing them if they are actively trying to crash them, or some other person is actively trying to run them off the road. They can put in a few basic features like seat belts and airbags to help the passengers, but if somebody actively wants to harm the people in the car, then there's a good chance they will be able to do it.