Researchers show NativeMessaging API attack on 1Password, EU eID, Google Drive

Researchers have conducted an empirical security analysis of the browser NativeMessaging API, uncovering a novel attack vector that enables non-privileged native applications to intercept sensitive communications or launch confused deputy attacks. The study demonstrates concrete attacks against popular apps including 1Password, the European Union's eID system, and Google Drive, affecting extensions with over 532 million cumulative downloads. The vulnerabilities arise because native messaging relies on an untrusted communication channel without client attestation or a root of trust, though the authors propose message encryption with out-of-band secret sharing as a mitigation. Open article →