Browser IDE Token Hand-off Becomes GitHub Exposure
A browser-based VS Code session can hand an attacker far more than the page or repo the user opened. The weak point is the trust link between github.com and github.dev: a crafted webview can trigger extension install flows and steal the GitHub OAuth token that github.dev receives, which then works across every repo the user can reach.
The public proof-of-concept shows malicious JavaScript running inside a webview, simulating editor clicks to install an extension, then extracting the token and using GitHub’s API to list private repositories. Microsoft has not patched it and no CVE has been assigned; the token is not scoped to a single repo, so revoking interest in one project does not contain the exposure.
For teams using browser-based IDEs or other embedded apps that accept OAuth tokens, the practical break is that one consent path can open an account-wide GitHub view. The risk sits in the handoff itself, not in password theft.