Project Zero uncovers severe security hole within Grammarly

Grammarly is used by over 22 million people

Project Zero uncovers severe security exploit within Grammarly

Project Zero uncovers severe security hole within Grammarly

Grammarly is a tool that is designed to enhance a user's writing by catching typos, missing words, punctuation or otherwise addressing mistakes. Google's Project Zero, the team which first uncovered both Spectre and Meltdown, has now discovered a security bug within Grammarly, one which allows websites to access documents and logs through the apps Chrome extension. 

Below is a comment on the issue from Tavis Ormandy, a vulnerability researcher at Google;

    The Grammarly chrome extension (approx ~22M users) exposes it's auth tokens to all websites, therefore any website can login to grammarly.com as you and access all your documents, history, logs, and all other data. I'm calling this a high severity bug, because it seems like a pretty severe violation of user expectations.

Users would not expect that visiting a website gives it permission to access documents or data they've typed into other websites.

This security hole was fixed "within a few hours" of being informed about the issue, with the extension auto-updating to secure the app. A similar patch has also been released for other browser-based versions of Grammarly. While the speed of these updates is commendable, it does not counter the fact that such a flaw was not discovered earlier by Grammarly earlier, as it left user data in an easily exposable state.  

The security blunder does not affect the Grammarly keyboard app, their Microsoft office add-in or text that has been typed on websites using the extension, though at this time it is unknown whether or not this issue has ever been exploited outside of Google's Project Zero.   


Project Zero uncovers severe security exploit within Grammarly  

While it is nice to see Grammarly quickly patch this issue and be so open about the problem, this exploitable security hole will undoubtedly leave a stain on the company's reputation.  

You can join the discussion on Project Zero's discovery of a security hole within Grammarly on the OC3D Forums

«Prev 1 Next»

Most Recent Comments


Register for the OC3D Newsletter

Subscribing to the OC3D newsletter will keep you up-to-date on the latest technology reviews, competitions and goings-on at Overclock3D. We won't share your email address with ANYONE, and we will only email you with updates on site news, reviews, and competitions and you can unsubscribe easily at any time.

Simply enter your name and email address into the box below and be sure to click on the links in the confirmation emails that will arrive in your e-mail shortly after to complete the registration.

If you run into any problems, just drop us a message on the forums.