GitHub OAuth Token Theft via VS Code Webview

Researchers from Socket Security disclosed a vulnerability in how VS Code handles GitHub authentication that lets malicious extensions steal OAuth tokens. The attack is notable because it bypasses GitHub's token binding protections by exploiting how VS Code webviews handle authentication flows.

The vulnerability is in the webview panel system. VS Code extensions can create webview panels that load web content. When a webview initiates a GitHub OAuth flow, the authentication happens in the webview context, not the main VS Code window. The resulting token is accessible to the extension that created the webview.

This matters because GitHub's OAuth tokens are bound to specific applications and use cases. A token granted to a VS Code extension for repository access should not be accessible to arbitrary web content. The webview bridge breaks that boundary.

An attacker would need to get a victim to install a malicious extension. That is easier than it sounds. VS Code's extension marketplace has minimal security review. Extensions can update themselves without user intervention. A seemingly benign extension could add the webview exploitation in a later update.

Once the token is stolen, the attacker has persistent access to the victim's GitHub repositories. The token is valid until explicitly revoked, and most users do not review their authorized OAuth applications regularly.

GitHub acknowledged the issue and is working with Microsoft on a fix. In the meantime, users should be cautious about installing VS Code extensions, especially those that request GitHub authentication. Review your authorized OAuth applications and revoke access for anything you do not recognize.

The broader lesson is about trust boundaries in development tools. VS Code webviews are supposed to be isolated from extension code. This vulnerability shows that isolation is not complete, and authentication flows that cross those boundaries need additional scrutiny.