Microsoft fixes critical VS Code Workspace Trust bypass CVE-2026-81376 (CVSS 9.6); researcher awarded $4,000
Microsoft awarded researcher Sam Chen (Samchen) US$4,000 for reporting CVE-2026-81376, a critical (CVSS 3.1 score 9.6) Workspace Trust security feature bypass in Visual Studio Code versions before 1.136.2. A specially prepared workspace could connect to an attacker-controlled service and bypass Restricted Mode, potentially exposing local …