CVE-2018-6654 The Grammarly extension before 2018-02-02 for Chrome allows remote attackers to discover authentication tokens via an 'action: "user"' request to iframe.gr_-ifr, because the exposure of these tokens i...
HighCVSS 8.8
EPSS 0.51%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Grammarly extension before 2018-02-02 for Chrome allows remote attackers to discover authentication tokens via an 'action: "user"' request to iframe.gr_-ifr, because the exposure of these tokens is not restricted to any specific web site.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| grammarly | = 2018-02-02 | No fix listed |
References
- bugs.chromium.org exploit issue-tracking third-party-advisory