Evernote patches flaw potentially affecting 4.6 million users of Google Chrome extension

The flaw was fixed last month.

Evernote last month fixed a security flaw in a Google Chrome extension that could have allowed hackers to access information about roughly 4.6 million users, according to new research.

Security vendor Guardio announced Wednesday it had discovered a vulnerability in Evernote’s Web Clipper extension for Chrome that could have allowed attackers to bypass the browser’s “same origin policy,” a security protocol meant to limit malicious scripts from spreading.

Exploiting the flaw would have allowed attackers to gain privileges outside Evernote’s domain in Chrome — including access to a user’s other web content and services, researchers said.

Evernote resolved the flaw within days, Guardio said, and there is no evidence the bug was exploited.

Evernote did not respond to a request for comment from CyberScoop. The California company designs note-taking software that syncs and archives user files like lists, file attachments and websites between multiple devices.

“Evernote was at the top of the list of services our users use and when we did a static code analysis we found this vulnerability,” said Michael Vainshtein, Guardio’s chief technology officer.  “The deployed a fix within just a number of days, maybe two or three, after we discussed it. They were great.”

Guardio was formed roughly a year ago by veterans of the Israeli military’s cybersecurity units. The company examines source code of extensions in Google’s Chrome store for potential anomalies.

The vulnerability, classified as CVE-2019-12592 in the MITRE vulnerability database, could have given a hacker access to information such usernames and passwords, financial data, social media conversations and emails.

This disclosure comes roughly two months after Evernote implemented a security update for an unrelated vulnerability that could have allowed attackers to run malicious code in Evernote version 7.9 for macOS.

Before that, Evernote was forced to abandon a policy that would have allowed employees to read users’ notes had users not noticed an update that stated “… you cannot opt out of employees looking at your content.” The site also forced 50 million of its users to reset their passwords in 2013 following a security incident.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure