Proton Exploit -
When possible, use native desktop or mobile apps which often have different attack surfaces than web-based versions. If you'd like to refine this draft, tell me if you want to:
Proton maintained its commitment to security through its Responsible Vulnerability Disclosure Policy . Proton Exploit
Analysis of spam and virus filter logs showed no evidence of the exploit being used in the wild by malicious actors. When possible, use native desktop or mobile apps
Proton Mail XSS Vulnerability: A Deep Dive into the 2022 Exploit Proton Mail XSS Vulnerability: A Deep Dive into
If successful, the script would run in the victim's session, allowing the attacker to "see" what the user sees—effectively stealing the decrypted content of their inbox. Proton's Response and Resolution
The Sonar Research team identified the vulnerability during a routine audit of Proton's open-source repositories. The issue stemmed from how the web application handled user-controlled HTML. While senders need the ability to style messages, failing to properly sanitize certain tags can allow malicious tags to execute in a reader's browser. How the Exploit Worked
The attack required a specific sequence of actions to succeed, which limited its real-world viability: