⚠️ VS Code Zero-Day: One Click and Your GitHub Token Is Stolen
On this page
A critical zero-day vulnerability in VS Code's browser-based github.dev editor lets attackers steal GitHub OAuth tokens with a single click. The exploit, published by security researcher Ammar Askar on June 2, 2026, targets the webview message-passing system to inject a malicious extension that exfiltrates authentication tokens. With exploit code already public and no patch from Microsoft, every developer needs to take immediate action.
This incident is a critical reminder that password security alone is not enough in modern threat models. Even the strongest password — generated by a password generator — cannot protect against OAuth token theft that bypasses authentication entirely.
What Is the VS Code Zero-Day and How Does It Work?
The vulnerability exploits github.dev (github.dev/tutorial), a browser-based version of VS Code that runs entirely in the web browser. Unlike the desktop VS Code application, github.dev relies on OAuth tokens for GitHub authentication — and this creates the attack surface.
The exploit chain works through the VS Code webview message-passing system, a legitimate API feature that extensions use to communicate with embedded web views. Here is the exact attack flow:
- An attacker crafts a special URL pointing to github.dev with a weaponized parameter
- The victim clicks the link — one click, no additional prompts
- The parameter targets the webview message-passing channel to inject a fake extension
- The fake extension appears legitimate in the VS Code UI with no visual indicators
- The extension reads the user's GitHub OAuth token from the active session
- The token is exfiltrated to an attacker-controlled server
The stolen OAuth token provides unrestricted access to every repository the victim can access — public, private, internal, and organization repositories. For developers with CI/CD pipeline access, the blast radius extends to deployment credentials and infrastructure-as-code configurations.
Why Did the Researcher Choose Full Disclosure?
Security researcher Ammar Askar published the exploit with just one hour's notice to Microsoft, a decision rooted in a negative prior experience with the company's vulnerability disclosure process. In a 2022 blog post, Askar described finding a critical remote code execution vulnerability in VS Code's GitHub Repositories extension. He reported it through Microsoft's bug bounty program, but the fix was deployed as a "reliability improvement" — without CVE assignment, without researcher credit, and without a bounty payment.
As Askar stated: "In my past experience reporting github.dev bugs to them, they tell you that it's out of scope and go report it to MSRC. And as I outlined in the article, I really don't want to deal with MSRC on VSCode bugs."
This pattern reflects a growing rift in the security research community. According to CISA's Known Exploited Vulnerabilities (KEV) catalog, the median time from vulnerability disclosure to active exploitation has dropped from 63 days in 2022 to just 12 hours in 2026, driven by AI-assisted reverse engineering. When researchers feel their coordinated disclosure efforts are dismissed, full disclosure becomes an increasingly attractive choice.
The Broader Security Implications
The OAuth token model is foundational to modern authentication, and this exploit exposes a fundamental vulnerability in how platform-level authentication is handled. Key implications:
- OAuth tokens are high-value targets. Unlike passwords, which require cracking or phishing, OAuth tokens are pre-authorized and often long-lived. The NIST SP 800-63B guidelines recommend limiting token lifetimes, but GitHub tokens can be configured with no expiration.
- Browser-based tools create new attack surfaces. The webview API is standard across multiple IDEs and platforms. Similar vulnerabilities likely exist in other browser-based development tools.
- Supply chain risk is real. A compromised developer token can inject malicious code into repositories, affecting downstream users. The SolarWinds attack demonstrated what happens when trusted build pipelines are compromised.
- Hardware 2FA is your best defense. Microsoft research confirms that MFA blocks 99.9% of automated account attacks. FIDO2/WebAuthn hardware tokens are phishing-resistant and cannot be bypassed by OAuth token theft alone.
How to Protect Your Accounts Right Now
Clear Browser Data for github.dev
This removes any cached OAuth session. In Chrome/Edge: Settings → Privacy and Security → Clear browsing data → Advanced → Clear cookies and site data for github.dev. In Firefox: Options → Privacy & Security → Manage Data → search for "github.dev" → Remove.
Revoke and Regenerate All GitHub Tokens
Go to GitHub Settings → Developer Settings → Personal access tokens. Revoke every existing token — both fine-grained PATs and classic tokens. Create new tokens with the minimum necessary scopes: use repo:read instead of repo, and never create tokens without expiration dates.
Enable FIDO2/WebAuthn Hardware 2FA
Hardware-based MFA is the strongest second factor available. Unlike TOTP codes or SMS, FIDO2 tokens are phishing-resistant. GitHub supports security keys — enable it under Settings → Password and authentication → Two-factor authentication.
Review Audit Logs
Check GitHub's security log (Settings → Security → Security log) for unrecognized IP addresses, unexpected device authorizations, or suspicious repository access. If you find anything unusual, assume compromise and rotate all tokens.
Adopt Forward-Looking Security Practices
Consider adopting passkeys — cryptographic key pairs that replace passwords entirely. Google, Apple, Microsoft, and Amazon now support passkeys, with over 15 billion accounts enabling passkey sign-in. For organizations, implement OAuth 2.0 token exchange with short-lived tokens to reduce blast radius.
For additional privacy when accessing development accounts from untrusted networks, Hide My Name VPN encrypts your connection. For encrypting sensitive communications, TrekMail encrypted email provides end-to-end encryption for security-conscious teams.
FAQs
How does the VS Code zero-day exploit work?
The exploit targets github.dev, the browser-based VS Code editor. A crafted URL weaponizes the webview message-passing API to inject a fake extension that steals the user's GitHub OAuth token. One click — no password entry, no download, no permission prompt.
Does this exploit steal passwords or API keys?
It steals GitHub OAuth tokens specifically. OAuth tokens are pre-authorized session credentials. While passwords may not be directly targeted, the blast radius includes all source code the compromised token can access.
Is there a patch yet?
As of June 3, 2026, Microsoft has not released a patch. Mitigations: clear browser cookies for github.dev, revoke all existing GitHub tokens, regenerate with minimum scopes. Monitor GitHub Security Advisories for the official fix.
Why did the researcher choose full disclosure?
Researcher Ammar Askar chose full disclosure after a previous VS Code vulnerability he reported was silently fixed without credit, CVE assignment, or bounty. He no longer trusts Microsoft's disclosure process for VS Code bugs.
How can organizations protect their repos?
Mandate hardware 2FA for all developers, enforce minimum token scopes, implement automated token rotation with 30-day expiry, monitor GitHub audit logs, and develop an incident response plan for mass token revocation.
Should I use a password manager for my GitHub account?
Yes — while this zero-day exploits OAuth tokens, a strong, unique password generated by a password generator is your first line of defense against credential-stuffing and password reuse across services.
Affiliate Disclosure: This post may contain affiliate links. If you purchase through these links, we may earn a small commission at no extra cost to you. Our password generator is free to use. Full disclosure.
