Besides, numerous firms own the Screencastify subdomains for various functionalities (excluding hosting companies), which may be prone to XSS vulnerabilities.

The usual functionality of Screencastify includes integration with its website for video-editing features and gaining full access to Google Drive to store recorded videos. While the purpose sounds useful, any vulnerability in this extension can be equally lethal for a user’s online security.Īccording to a recent post from Palant, a cross-site scripting vulnerability riddled Screencastify Chrome extension, threatening user security. The user can then store ad share these videos with others as needed. The extension allows the user to start screen recording and make videos via webcam. Screencastify is a screen recording Chrome browser extension that gained popularity for educational and teaching purposes. Screencastify Chrome Extension Vulnerability

Users need to remain careful since the bug remains partially unpatched (until writing this story), thus risking the users. An adversary could exploit this bug to sneakily record videos and steal videos alongside any other data from the Google account where the extension would save the video. Researchers discovered a critical security vulnerability in the Screencastify Chrome extension that could allow webcam hijacking.

Screencastify chrome extension