CVE-2024-28120

codeium-chrome is an open source code completion plugin for the chrome web browser. The service worker of the codeium-chrome extension doesn't check the sender when receiving an external message. This allows an attacker to host a website that will steal the user's Codeium api-key, and thus impersonate the user on the backend autocomplete server. This issue has not been addressed. Users are advised to monitor the usage of their API key.

• CWE-200
• CWE-284

• https://github.com/Exafunction/codeium-chrome/security/advisories/GHSA-8c7j-2h97-q63pExploit, Vendor Advisory
• https://securitylab.github.com/advisories/GHSL-2024-027_GHSL-2024-028_codeium-chromeExploit, Third Party Advisory
• https://github.com/Exafunction/codeium-chrome/security/advisories/GHSA-8c7j-2h97-q63pExploit, Vendor Advisory
• https://securitylab.github.com/advisories/GHSL-2024-027_GHSL-2024-028_codeium-chromeExploit, Third Party Advisory

Published

Mar 11, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-28115FreeRTOS is a real-time operating system for microcontroller…7.8
• CVE-2024-28116Grav is an open-source, flat-file content management system.…8.8
• CVE-2024-28117Grav is an open-source, flat-file content management system.…8.8
• CVE-2024-28118Grav is an open-source, flat-file content management system.…8.8
• CVE-2024-28119Grav is an open-source, flat-file content management system.…8.8
• CVE-2024-2812A vulnerability was found in Tenda AC15 15.03.05.18/15.03.20…8.8
• CVE-2024-28121stimulus_reflex is a system to extend the capabilities of bo…8.8
• CVE-2024-28122 JWX is Go module implementing various JWx (JWA/JWE/JWK/JWS/…6.8
• CVE-2024-28123Wasmi is an efficient and lightweight WebAssembly interprete…9.8
• CVE-2024-28125FitNesse all releases allows a remote authenticated attacker…9.8
• CVE-2024-28126Cross-site scripting vulnerability exists in 0ch BBS Script …6.1
• CVE-2024-28127Improper input validation in UEFI firmware for some Intel(R)…8.7