Preliminary research

Stealing GitHub tokens via VS Code webview keyboard event bubbling

Ammar Askar · Ammar's Blog

AI-collected research leads through 6 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

VSCode webviews are cross-origin iframes, but to keep shortcuts working they forward their own keydown events to the host over postMessage, and the host cannot tell a synthetic event from a real keypress. Javascript in a notebook cell sends Ctrl+Shift+A to accept the recommended-extension prompt, installing a local workspace extension whose keybinding calls installExtension with skipPublisherTrust, and that extension reads github.dev's unscoped GitHub token.

Record

Researcher

Ammar Askar

Published by

Ammar's Blog

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Proof-of-concept extension
• Proof-of-concept notebook
• Original vulnerability report

Tags

• postmessage
• iframe
• sandbox-escape
• javascript
• github
• info-leak
• attack-chain
• electron

This page is the archive's own catalogue record. The research is the work of Ammar Askar, first published at the original source. Preserved copies are kept so the citation survives its host.