VS Code Webview Flaw Enabled One-Click Theft of GitHub OAuth Tokens

Security researcher Ammar Askar disclosed a zero-day in Visual Studio Code’s webview message-handling that allowed attackers to steal GitHub OAuth tokens from github.dev with a single malicious link. The attack abused forwarded keyboard events and simulated keypresses to cross the webview security boundary, silently install a malicious extension, and extract the token that GitHub passes to the browser-based editor. Multiple reports said the token was broadly scoped rather than limited to the repository being viewed, giving access to all repositories the victim could reach, including private repositories with read/write permissions.

The exploit chain was also reported to affect desktop VS Code in some scenarios involving attacker-controlled repositories and malicious workspace content, though Microsoft said the issue did not affect VS Code Desktop and later indicated the problem had been fixed in its services. Public reporting tied the disclosure to a dispute over Microsoft’s vulnerability-handling process, with Askar saying he notified GitHub shortly before release and published proof-of-concept code without coordinated disclosure. Recommended precautions included avoiding untrusted github.dev links, clearing saved site data for github.dev, and reviewing installed extensions for suspicious additions.