Browser IDE token hand-off becomes GitHub exposure
A browser-based VS Code session can hand an attacker far more than the page or repo the user opened. The weak point is the trust link between github.com and github.dev: a crafted webview can trigger extension install flows and steal the GitHub OAuth token that github.dev receives, which then works across every repo the user can reach.
The public proof-of-concept shows malicious JavaScript running inside a webview, simulating editor clicks to install an extension, then extracting the token and using GitHub’s API to list private repositories. Microsoft has not patched it and no CVE has been assigned; the token is not scoped to a single repo, so revoking interest in one project does not contain the exposure.
For teams using browser-based IDEs or other embedded apps that accept OAuth tokens, the practical break is that one consent path can open an account-wide GitHub view. The risk sits in the handoff itself, not in password theft.
Researcher publishes GitHub token-stealing exploit, blames Microsoft’s disclosure process
The security researcher, Ammar Askar, released the new proof-of-concept exploit on his personal blog — alongside the public tracker for issues in VS Code — giving a GitHub security contact roughly one hour's notice beforehand.