You can disable harmful extensions to keep your network free from browser-based vulnerabilities.Īlternatively, you can whitelist extensions you know and trust, ensuring that only those extensions you’ve whitelisted are present in your network. Browser Security Plus’ add-on management feature provides insights on the various extensions present in your network, including which among those are harmful. ManageEngine Browser Security Plus is enterprise security software that helps prevent web-based cyberattacks.

With close to 8,500 extensions in the web store, many with similar vulnerabilities capable of leading to a data breach, how do know which extensions are harmful? And how do you prevent users from installing vulnerable extensions in your network? Finding and eliminating browser vulnerabilities is a challenge, but with the right tools, it can be easy. The vulnerability in Web Clipper exposed sensitive enterprise data accessed by its users via Chrome browsers to hackers, putting many organizations at risk of data breaches.

Impact of the vulnerability on organizationsīrowsers have become an indispensable tool in most work environments, allowing users to get work done using cloud-based applications. The vulnerability in Evernote’s Web Clipper extension, named CVE-2019-12592, allowed hackers to bypass the same-origin policy this meant that hackers could read, change, and steal data accessed on the browsers, and enable Universal Cross-Site Scripting on Chrome.

This mechanism helps isolate potentially malicious resources, reducing possible cyberattacks. Same-origin policy is a security mechanism that restricts interaction between resources from different origins. Web Clipper, an extension that allows users to save screenshots of webpages, emails, images, articles, etc., had a vulnerability that provided hackers with easy access to the websites accessed by its 4.5 million users before it was fixed on May 31, 2019. A critical vulnerability in Evernote’s Web Clipper Chrome extension recently allowed hackers to steal data present in active web sessions.

What is evernote web