Flaw in Grammarly Browser Extension Exposed User Documents

Flaw in Grammarly Browser Extension Exposed User Documents

Sometimes words are hard, and that’s why some 22 million people have installed the Grammarly extension for Chrome. Grammarly promises to catch your typos and grammatical errors, but for a while, it was also exposing your personal documents to potential snooping by any website you visited. That the sort of breach of trust that can spell doom for a startup.

Grammarly goes beyond a normal spell checker by assessing your sentence structure and word usage. It operates on websites in virtually any text field, but there’s also a dedicated editing interface if you want to go through a larger block of text. Grammarly is popular because it can point out things in your writing that you might never notice yourself. It’s like having a copyeditor living inside your computer, but many of the advanced features require a paid subscription to the service.

The full Grammarly editor is where Grammarly ran into an issue. After entering text into the editor, the flaw made it available to anyone who knew how to look for it. According to Google Project Zero researcher Tavis Ormandy, the extension had a critical bug that exposed the user’s auth token. That’s as good as handing over your user name and password.

With your auth token, a website could log into the Grammarly service as you. That means all your documents saved in Grammarly would be accessible. If you dropped an email to your lawyer or your significant other into Grammarly’s editor, they were hanging out in the open for anyone to snatch. Thankfully, text that you typed in other websites that was merely scanned on the fly by Grammarly was never in jeopardy.

This code demonstrates how a website could pull your auth token from Grammarly.
This code demonstrates how a website could pull your auth token from Grammarly.

To its credit, Grammarly acted quickly when alerted by Project Zero. Developers pushed out an update that patched the security hole that exposed auth tokens in the first place. The company says it has no evidence that any websites exploited this vulnerability to steal data from users. That suggests Tavis Ormandy was the first one to spot the issue, which is very much why Google’s Project Zero exists.

If some online criminal had found this hole before Ormandy, there could have been a lot of upset Grammarly users. That probably would have been the end of Grammarly as a company as well. So, there’s no emergency — you don’t need to run to your computer and nuke Grammarly. Just make sure all your Chrome extensions are set to automatically update.

Continue reading

Google Pixel Slate Owners Report Failing Flash Storage
Google Pixel Slate Owners Report Failing Flash Storage

Google's product support forums are flooded with angry Pixel Slate owners who say their devices are running into frequent, crippling storage errors.

Western Digital Changes Its Reported Drive Speeds to Reflect Reality
Western Digital Changes Its Reported Drive Speeds to Reflect Reality

Western Digital has launched new WD Red Plus models to correct previous communicated inaccuracies regarding the spindle speeds on its 8TB-14TB products in this family.

No Flying Cars Yet, But How About a $300 Toaster With a Touch Screen?
No Flying Cars Yet, But How About a $300 Toaster With a Touch Screen?

As 2020 draws to a close, there's still no word on flying cars, but don't worry: We found something even better. For a certain definition of the word "better."

Ripples Reveal Ancient Global Megafloods on Mars
Ripples Reveal Ancient Global Megafloods on Mars

New findings from the Curiosity rover point to megafloods in the planet's past. NASA couldn't see the evidence of this event from space, but Curiosity was able to make the determination by scanning Martian geology from the surface.