Security Flaw in Hoppscotch Browser Extension Exposes User Data

Summary

The Hoppscotch Browser Extension, designed for a community-driven API development ecosystem, has a significant vulnerability that arises from a critical oversight in the codebase. Specifically, during a recent update, the developers failed to implement essential checks for the approved origin list, thus allowing any website to communicate with the extension's internal APIs. This exposure results in the ability for malicious sites to bypass Cross-Origin Resource Sharing (CORS) restrictions by sending requests to the extension. Consequently, users of affected versions (0.34 and earlier) are at risk of unauthorized data access. The issue has been addressed in the latest release, version 0.35, while users are advised to review their extension access settings, particularly on Chrome, to restrict origins. Firefox users are urged to upgrade to the patched version for security.

References