Google Antigravity IDE browser extension flaw enables arbitrary file write and RCE via SaveScreenRecording path traversal ($10,000 bounty)
Hacktron researcher sudi disclosed a vulnerability in the browser extension bundled with Google's AI IDE Antigravity, which is built on the same internals as Windsurf. The extension's externallyconnectable setting allows any web page to send messages to it. The SaveScreenRecording action forwards attacker-controlled filename and L fields …