Nonetheless, Microsoft fixed this matter in June 2021 by shutting down the Skype server. That’s because the conversation stealthily started from the user’s end, without him knowing. In the case of a malicious website, the adversary could deceptively start a Skype conversation, spamming the user with messages. That anybody can put into the Skype search to see your name and avatar. So the website can read it out trivially: console.log(sessionStorage) This will produce an output like “8:live.cid.0123456789abcdef.” And the part after “8:” is your Skype ID. In content script context sessionStorage is no longer extension’s storage, it’s the website’s. Then, for a signed-in user, the extension would expose users’ identity details stored in the extension’s session storage. The attack only required the user to be signed in to a Microsoft account, whether it is an Outlook account, a Skype ID, or any other Microsoft platform. Thus, an adversary could easily know the user’s identity by exploiting the bug via any random website.

While the extension typically supported integration with certain websites only (like Gmail), it would continue working on other websites too. In simple words, the extension would integrate the chat functionality to a website a user visits.

Specifically, the Skype extension for Chrome was supposed to offer a direct means of starting Skype conversations within the browsers’ environment.

Microsoft Fixed The Chrome Skype Extension Privacy FlawĮlaborating on the details via a blog post, researcher Wladimir Palant mentioned how a security flaw riddled the Skype Chrome extension. Thankfully, Microsoft fixed the vulnerability by rolling out an overhauled extension version for the users. A serious security flaw in Microsoft’s Skype extension for Chrome browser risked users’ privacy.

Skype for web chrome