One Click Away: Critical VSCode Flaw Exposes Your GitHub Credentials

The vulnerability targets developers using VSCode's browser-based github.dev tool, which runs with GitHub OAuth tokens that have unrestricted access to all user repositories, including private ones. An attacker can steal these tokens with a single click by exploiting a flaw in VSCode's webview sandbox model, immediately gaining full repository access. This incident highlights how OAuth overpermissioning combined with browser sandbox bypasses can create critical security risks in developer-focused tools.