'So, the question whether to keep using Screencastify at this point boils down to whether you trust Screencastify, Pendo, Webflow, Teachable, Atlassian, Netlify, Marketo and ZenDesk with access to your webcam and your Google Drive data,' he concludes. The Register asked Google whether it would care to comment on Palant's observation that Google Drive access is too broadly scoped, but we've not heard back. So too is the onConnectExternal handler that lets websites start video recordings.

The API, he observed, does not appear to have been restricted and will still produce a Google OAuth token that can be used to access a victim's Google Drive, Palant said. The message he received also mentioned a long-term plan to implement Content Security Policy protection, but as of May 23, according to Palant, that hasn't happened on nor apart from the addition of framing protection. A day later, the XSS on the error page was fixed. Palant said he reported the issue on February 14, 2022, and his message was acknowledged the same day. It could also list Google Drive contents or start a recording session. Thereafter, the page could message Screencastify to fetch the victim's Google access token and ask Google for the user's identity. So his proof-of-concept attack did just that, loading the vulnerable page in an invisible frame and positioning it under the mouse cursor so any click would be passed through to the hidden button. But as Palant observed, the page contained no protection against framing, meaning it was susceptible to clickjacking. To make that happen, the attacker would still need to trick the victim into clicking on this button.

Critical bug allows attacker to remotely control medical robot.DMCA-dot-com XSS vuln reported in 2020 still live today and firm has shrugged it off.Anatomy of a campaign to inject JavaScript into compromised WordPress sites.for Google: Web giant talks up 40 new Chromebook models, school-focused ChromeOS

So, if the query string parameter is something like javascript:alert(document.domain), will clicking this button run JavaScript code in the context of the domain? It sure will!' 'Is there some link validation in between? Nope. 'It’s a query string parameter,' Palant explains in his post. The page contained a “View on Classroom” button that sent the user to Google Classroom using this code: window.open(urseworkLink) Palant found an XSS bug on an error page that gets presented when a user tries to submit a video after already submitting one for an assignment.

How to remove screencastify from chrome