- Anyone with this extension installed could be trivially owned by any website.
- AVG's initial fix was to incorrectly whitelist their own domains without requiring SSL.
- The follow up fix (after more harsh words from google) whitelists the AVG domain with SSL. Google engineer points out a obvious XSS on the domain that would again allow any chrome user to get owned.
This is a security extension from a security vendor. No words.
- Anyone with this extension installed could be trivially owned by any website.
- AVG's initial fix was to incorrectly whitelist their own domains without requiring SSL.
- The follow up fix (after more harsh words from google) whitelists the AVG domain with SSL. Google engineer points out a obvious XSS on the domain that would again allow any chrome user to get owned.
This is a security extension from a security vendor. No words.