One-Click GitHub Token Theft via VS Code Webview Keyboard Ev...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://blog.ammaraskar.com/github-token-stealing
• Blog Title: One-Click GitHub Token Theft via VS Code Webview Keyboard Event Injection
• Suggested Section: Network Services Pentesting > Pentesting Web Methodology > Electron Desktop Apps, as a new subsection/page on VS Code and Electron webview synthetic keyboard-event injection, declarative extension command bridges, and privileged shortcut abuse

🎯 Content Summary

Overview

The post presents a one-click exploit chain against github.dev and the VS Code webview security boundary. By opening an attacker-controlled Jupyter notebook, a victim could allow JavaScript running inside a supposedly isolated notebook webview to synthesize keyboard shortcuts, install an attacker-selected VS Code extension, and steal a GitHub OAuth token with read and write access to every repository available to the victim, including private repositories. No CVE...

🔧 Technical Details

Synthetic keyboard-event escape from sandboxed webviews: If an application forwards keyboard events from an untrusted cross-origin iframe to a privileged host so global shortcuts continue working, attacker-controlled iframe JavaScript may dispatch synthetic KeyboardEvent objects and make the host execute privileged shortcuts. The dangerous design copies attacker-controlled properties such as key, keyCode, code, ctrlKey, shiftKey, altKey, and metaKey without ensuring that the event represents trusted physical input. Exploitation uses calls such as window.dispatchEvent(new KeyboardEvent("keydown", {...})). Applications should not generically bubble events across trust boundaries and should require trusted user activation or expose narrowly scoped message operations.

Shortcut-oriented exploitation when synthetic typing is blocked: ...

🤖 Agent Actions

Updated src/network-services-pentesting/pentesting-web/electron-desktop-apps/README.md.

Added a new VS Code / github.dev subsection covering:

• synthetic KeyboardEvent abuse across webview → host boundaries
• shortcut-oriented exploitation when synthetic typing is blocked
• .vscode/extensions.json notification abuse
• local workspace extensions as declarative command bridges
• runCommands / workbench.extensions.installExtension abuse and skipPublisherTrust
• trusted-workspace abuse and post-compromise GitHub token scope amplification
• technical audit/mitigation notes

Also appended references for the July 2026 research, VS Code issue #319593, PRs #319705 / #319813, and local workspace extension docs.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://blog.ammaraskar.com/github-token-stealing

Content Categories: Based on the analysis, this content was categorized under "Network Services Pentesting > Pentesting Web Methodology > Electron Desktop Apps, as a new subsection/page on VS Code and Electron webview synthetic keyboard-event injection, declarative extension command bridges, and privileged shortcut abuse".

Repository Maintenance:

• MD Files Formatting: 990 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0