AVG: “Web TuneUP” extension multiple critical vulnerabilities
So:- Anyone with this extension installed could be trivially owned by any website.- AVG's initial fix was to incorrectly whitelist their own domains without requiring SSL.- The follow up fix (after more harsh words from google) whitelists the AVG domain with SSL. Google engineer points out a obvious XSS on the domain that would again allow any chrome user to get owned.This is a security extension from a security vendor. No words.