Project Zero uncovers severe security hole within Grammarly

Grammarly is a tool that is designed to enhance a user’s writing by catching typos, missing words, punctuation or otherwise addressing mistakes. Google’s Project Zero, the team which first uncovered both Spectre and Meltdown, has now discovered a security bug within Grammarly, one which allows websites to access documents and logs through the apps Chrome extension. 

Below is a comment on the issue from Tavis Ormandy, a vulnerability researcher at Google;

    The Grammarly chrome extension (approx ~22M users) exposes it’s auth tokens to all websites, therefore any website can login to grammarly.com as you and access all your documents, history, logs, and all other data. I’m calling this a high severity bug, because it seems like a pretty severe violation of user expectations.

Users would not expect that visiting a website gives it permission to access documents or data they’ve typed into other websites.

This security hole was fixed “within a few hours” of being informed about the issue, with the extension auto-updating to secure the app. A similar patch has also been released for other browser-based versions of Grammarly. While the speed of these updates is commendable, it does not counter the fact that such a flaw was not discovered earlier by Grammarly earlier, as it left user data in an easily exposable state.  

The security blunder does not affect the Grammarly keyboard app, their Microsoft office add-in or text that has been typed on websites using the extension, though at this time it is unknown whether or not this issue has ever been exploited outside of Google’s Project Zero.