VSCode Webview Flaw Let a Single Click Steal GitHub Tokens via github.dev

Researcher Ammar Askar found that github.dev — the browser-based VSCode that GitHub launches when you swap .com for .dev — receives a broadly-scoped OAuth token granting read/write access to every repo the user can reach, not just the one being viewed. That made the millions of lines of TypeScript powering VSCode a high-value attack surface, because any bug letting attacker JavaScript escape the editor’s sandbox would yield that token.

The escape lived in VSCode’s webview model. Webviews run in cross-origin iframes for isolation, but to keep keyboard shortcuts working when focus is inside one, the host registers a did-keydown message handler that forwards synthesized key events as if the user typed them. Untrusted webview content can post those messages itself, impersonating user keystrokes. Direct text entry into inputs is blocked by the browser, but VSCode’s built-in keybindings listen on keydown directly — so an attacker can drive the editor through shortcuts. Askar chained this with a workspace’s .vscode/extensions.json recommendation prompt and the Ctrl+Shift+A ‘accept primary notification action’ shortcut to one-click install a malicious extension, achieving code execution and token exfiltration.

The takeaway: scoping OAuth tokens to the resource in use would have limited blast radius, and any postMessage channel that forwards ‘user’ input from a sandboxed origin is effectively a confused-deputy primitive. Askar went public after disclosure, framing it as a case study in webview trust boundaries.