A function used to pass a URL to the extension’s namespace was not properly sanitized, allowing hackers to inject their own script-which is then injected into every web page-then allowing for data exfiltration. To enable this functionality, a JavaScript file is injected into every web page. The Evernote Web Clipper allows users to clip, highlight, annotate, and screenshot content of websites, and save it to an Evernote account. SEE: Working remotely: A professional’s guide to the essential tools (free PDF) (TechRepublic)

Evernote’s handling of the vulnerability is laudable, as the company issued an update (version 7.11.1) to address the vulnerability less than one week after being notified. The affected extension has over 4.6 million users, according to statistics on the Chrome Web Store, theoretically putting a large number of users at risk. The vulnerability-designated as CVE-2019-12592-allowed attackers to bypass Chrome’s same-origin policy, creating a situation in which “code could be executed that could allow an attacker to perform actions on behalf of the user as well as grant access to sensitive user information on affected third-party web pages and services, including authentication, financials, private conversations in social media, personal emails, and more,” according to a press release.

A cross-site scripting vulnerability in Evernote’s Web Clipper Chrome extension allowed hackers access to active sessions of other websites in the same browser, according to security company Guardio.

Evernote web clipper extension