/
← Voltar ao feed
high technology software development

Google Antigravity IDE browser extension flaw enables arbitrary file write and RCE via SaveScreenRecording path traversal ($10,000 bounty)

1 fonte(s) · 1 atualização(ões) · publicado 07/02/2026 21:00 · coletado há 1 dia

Hacktron researcher sudi disclosed a vulnerability in the browser extension bundled with Google's AI IDE Antigravity, which is built on the same internals as Windsurf. The extension's externally_connectable setting allows any web page to send messages to it. The SaveScreenRecording action forwards attacker-controlled filename and L fields to the local language server, which allows path traversal and an arbitrary file write anywhere the user can write. Google paid a $10,000 bounty. The article describes writing to the user's Startup folder as an easy route to code execution at the next reboot. The researcher also describes a bypass of Google's first fix, but the article is truncated before the full details.

Technical Details

  • Antigravity runs a Golang language server (language_server_windows_x64.exe) that validates the x-codeium-csrf-token header to defend against DNS rebinding. The token comes from crypto.randomUUID() and is injected only into the extension service worker via Playwright, so the researcher could not leak it.
  • Agent overlay functions such as window.updateActuationOverlay are exposed to web pages while the agent is running. They allow spoofing of UI prompts, but nothing more impactful was found.
  • The extension manifest sets externally_connectable to <all_urls>, so any website can call chrome.runtime.sendMessage() against the extension.
  • The SaveScreenRecording action calls the language server endpoint /exa.language_server_pb.LanguageServerService/SaveScreenRecording. The final path is C:\Users\<Username>\.gemini\antigravity\brain\[L]\[filename].
  • Traversal sequences in filename (for example ../poc.txt) and in L write attacker-controlled content outside the intended directory. The file is written even when the server returns an error.
  • Google's fix added an sh() sender check that validates the sender URL contains /static/offscreen.html, that the sender id equals chrome.runtime.id, and that the sender has no tab.
  • The URL check is bypassable by appending ?/static/offscreen.html to an attacker page URL. The researcher notes that the chrome.runtime.id check could be bypassed through a content-script message proxy, but Antigravity restricts the allowed actions. The article is cut off while discussing the tab check.

Remediation

  • Update Antigravity and its browser extension to the latest version.
  • Restrict externally_connectable to explicitly trusted origins.
  • Validate the sender in the extension rather than relying on url.includes() checks.
  • Canonicalize and validate file paths server-side to reject traversal sequences.

Linha do tempo

  1. hacktron.ai ↗ · pub. 07/02/2026 21:00 · coletado 19/10 18:03 primeiro registro

    Google Antigravity IDE browser extension flaw enables arbitrary file write and RCE via SaveScreenRecording path traversal ($10,000 bounty)

    ler a análise desta fonte

    Hacktron researcher sudi disclosed a vulnerability in the browser extension bundled with Google's AI IDE Antigravity, which is built on the same internals as Windsurf. The extension's externally_connectable setting allows any web page to send messages to it. The SaveScreenRecording action forwards attacker-controlled filename and L fields to the local language server, which allows path traversal and an arbitrary file write anywhere the user can write. Google paid a $10,000 bounty. The article describes writing to the user's Startup folder as an easy route to code execution at the next reboot. The researcher also describes a bypass of Google's first fix, but the article is truncated before the full details.

    Technical Details

    • Antigravity runs a Golang language server (language_server_windows_x64.exe) that validates the x-codeium-csrf-token header to defend against DNS rebinding. The token comes from crypto.randomUUID() and is injected only into the extension service worker via Playwright, so the researcher could not leak it.
    • Agent overlay functions such as window.updateActuationOverlay are exposed to web pages while the agent is running. They allow spoofing of UI prompts, but nothing more impactful was found.
    • The extension manifest sets externally_connectable to <all_urls>, so any website can call chrome.runtime.sendMessage() against the extension.
    • The SaveScreenRecording action calls the language server endpoint /exa.language_server_pb.LanguageServerService/SaveScreenRecording. The final path is C:\Users\<Username>\.gemini\antigravity\brain\[L]\[filename].
    • Traversal sequences in filename (for example ../poc.txt) and in L write attacker-controlled content outside the intended directory. The file is written even when the server returns an error.
    • Google's fix added an sh() sender check that validates the sender URL contains /static/offscreen.html, that the sender id equals chrome.runtime.id, and that the sender has no tab.
    • The URL check is bypassable by appending ?/static/offscreen.html to an attacker page URL. The researcher notes that the chrome.runtime.id check could be bypassed through a content-script message proxy, but Antigravity restricts the allowed actions. The article is cut off while discussing the tab check.

    Remediation

    • Update Antigravity and its browser extension to the latest version.
    • Restrict externally_connectable to explicitly trusted origins.
    • Validate the sender in the extension rather than relying on url.includes() checks.
    • Canonicalize and validate file paths server-side to reject traversal sequences.