The vulnerability in Web Clipper exposed sensitive enterprise data accessed by its users via Chrome browsers to hackers, putting many organizations at risk of data breaches.

Impact of the vulnerability on organizationsīrowsers have become an indispensable tool in most work environments, allowing users to get work done using cloud-based applications. The vulnerability in Evernote’s Web Clipper extension, named CVE-2019-12592, allowed hackers to bypass the same-origin policy this meant that hackers could read, change, and steal data accessed on the browsers, and enable Universal Cross-Site Scripting on Chrome. This mechanism helps isolate potentially malicious resources, reducing possible cyberattacks. Same-origin policy is a security mechanism that restricts interaction between resources from different origins.

Web Clipper, an extension that allows users to save screenshots of webpages, emails, images, articles, etc., had a vulnerability that provided hackers with easy access to the websites accessed by its 4.5 million users before it was fixed on May 31, 2019. A critical vulnerability in Evernote’s Web Clipper Chrome extension recently allowed hackers to steal data present in active web sessions.

Evernote chrome extension features