codeium-chrome is an open source code completion plugin for the chrome web browser. The service worker of the codeium-chrome extension doesn't check the sender when receiving an external message. This allows an attacker to host a website that will steal the user's Codeium api-key, and thus impersonate the user on the backend autocomplete server. This issue has not been addressed. Users are advised to monitor the usage of their API key.
References
| Link | Resource |
|---|---|
| https://github.com/Exafunction/codeium-chrome/security/advisories/GHSA-8c7j-2h97-q63p | Exploit Vendor Advisory |
| https://github.com/Exafunction/codeium-chrome/security/advisories/GHSA-8c7j-2h97-q63p | Exploit Vendor Advisory |
| https://securitylab.github.com/advisories/GHSL-2024-027_GHSL-2024-028_codeium-chrome | Exploit Third Party Advisory |
| https://securitylab.github.com/advisories/GHSL-2024-027_GHSL-2024-028_codeium-chrome | Exploit Third Party Advisory |
Configurations
History
26 Feb 2025, 15:14
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://securitylab.github.com/advisories/GHSL-2024-027_GHSL-2024-028_codeium-chrome - Exploit, Third Party Advisory | |
| References | () https://github.com/Exafunction/codeium-chrome/security/advisories/GHSA-8c7j-2h97-q63p - Exploit, Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CPE | cpe:2.3:a:codeium:codeium:1.2.52:*:*:*:*:chrome:*:* | |
| CWE | NVD-CWE-noinfo | |
| First Time |
Codeium
Codeium codeium |
11 Mar 2024, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-03-11 22:15
Updated : 2025-02-26 15:14
NVD link : CVE-2024-28120
Mitre link : CVE-2024-28120
JSON object : View
Products Affected
codeium
- codeium
CWE