DEV Community

Kokal Limited
Kokal Limited

Posted on Originally published at bestpasswordgenerator.org

VS Code Zero-Day: One Click and Your GitHub Token Is Gone

#passwordsecurity #onlinesafety #cybersecurity

A critical zero-day in VS Code's browser-based github.dev editor lets attackers steal your GitHub OAuth token with a single link click. Security researcher Ammar Askar published the exploit on June 2, 2026 — with only one hour's notice to Microsoft — and the code is already public.

How It Works

The attack targets the webview message-passing system, a legitimate VS Code API that extensions use to communicate with embedded web views. Here's the chain:

  1. Attacker crafts a malicious github.dev URL
  2. Victim clicks the link — no prompts, no warnings
  3. The URL injects a fake extension via the webview message channel
  4. The extension reads the active GitHub OAuth token
  5. Token is exfiltrated to an attacker-controlled server 
Victim clicks link
       ↓
github.dev loads with weaponized parameter
       ↓
Fake extension injected via webview API
       ↓
OAuth token silently read + sent to attacker
Enter fullscreen mode Exit fullscreen mode

The stolen token gives unrestricted access to every repo the victim can reach — private, public, internal, org repos, and potentially CI/CD credentials too.

Why Full Disclosure?

Askar didn't give Microsoft the usual 90-day window. His reasoning: in 2022 he reported a critical RCE in VS Code's GitHub Repositories extension through the bug bounty program. Microsoft shipped the fix labelled as a "reliability improvement" — no CVE, no researcher credit, no bounty.

His take:

"In my past experience reporting github.dev bugs to them, they tell you that it's out of scope and go report it to MSRC. And as I outlined in the article, I really don't want to deal with MSRC on VSCode bugs."

It's a familiar story in the security community, and it raises legitimate questions about how large vendors handle browser-based product vulnerabilities versus core product bugs.

What You Should Do Right Now

No patch exists yet. Protect yourself manually:

# 1. Revoke all existing GitHub tokens
# GitHub → Settings → Developer settings → Personal access tokens → Revoke all

# 2. If you use the GitHub CLI, re-authenticate
gh auth logout
gh auth login

# 3. Review recent token activity
gh api /user/installations
Enter fullscreen mode Exit fullscreen mode

Also:

  • Clear github.dev browser cookies and site data
  • Re-create tokens with minimum required scopes only
  • Enable hardware-based 2FA (FIDO2/WebAuthn — not SMS)
  • Check your GitHub audit log at github.com/settings/security-log

The Bigger Picture

This is a good reminder that a strong password alone doesn't protect you against OAuth token theft — the attacker never touches your password at all. Token hygiene (short-lived tokens, minimal scopes, regular rotation) matters as much as credential strength.

The median time from public disclosure to active exploitation has dropped to 12 hours in 2026, according to CISA's KEV catalog. If you use github.dev regularly, treat this as urgent.

Originally published on Best Password Generator

Top comments (0)