Spoofing Vulnerability

A spoofing vulnerability exists in VS Code 1.65.0 and earlier versions where the <iframe> used for rendering webviews could be embedded in a parent frame with an unexpected origin, and the <iframe> would communicate with the parent frame despite its unexpected origin.

Patches

The fix is available starting with VS Code 1.65.1. The fix (https://github.com/microsoft/vscode/commit/c569182d081410046ee6e6938e960d1e83063612) mitigates this attack by restricting the <iframe> origin to a value that is computed taking the parent frame origin into account, thus isolating different parent frame origins.

Workarounds

There are no known workarounds.

References

• The patch for this can be found at https://github.com/microsoft/vscode/commit/c569182d081410046ee6e6938e960d1e83063612
• An issue for this can be found at https://github.com/microsoft/vscode/issues/144703
• MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24526