VSCode Webview Bug Lets Attackers Steal GitHub Tokens With One Click
A new vulnerability in VSCode’s webview security model enables an attacker to steal a user’s GitHub OAuth token via a single malicious link, giving full access to private repositories. The flaw stems from keyboard event bubbling between isolated webviews and the main window. Ammar Askar’s blog details the exploit and mitigation steps.