AVG: “Web TuneUP” extension multiple critical vulnerabilities
So:<p>- Anyone with this extension installed could be trivially owned by any website.<p>- AVG's initial fix was to incorrectly whitelist their own domains without requiring SSL.<p>- The follow up fix (after more harsh words from google) whitelists the AVG domain with SSL. Google engineer points out a obvious XSS on the domain that would again allow any chrome user to get owned.<p>This is a <i>security</i> extension from a <i>security</i> vendor. No words.