Executive brief
linux-entra-sso is a browser extension that allows Linux users to sign into Microsoft Entra ID (formerly Azure AD) services automatically. A security flaw in the Chrome version of the extension could allow an attacker to steal a user's login session tokens if the user visits a specially crafted malicious link. If successful, an attacker could gain unauthorized access to the victim's Microsoft account and associated corporate applications until the session expires.
Technical details
The linux-entra-sso extension prior to version 1.8.1 uses an unanchored 'urlFilter' in its Chrome declarativeNetRequest rules. Specifically, the filter 'https://login.microsoftonline.com/*' is treated as a substring match by Chrome, meaning it will trigger on any URL containing that string, such as 'https://attacker.com/path/https://login.microsoftonline.com/'. When triggered, the extension's 'modifyHeaders' action attaches the Entra ID Primary Refresh Token (PRT) cookie to the request. An attacker can exploit this by inducing a user to navigate to a crafted URL, thereby capturing the PRT and hijacking the user's SSO session. The Firefox version was not affected due to an explicit 'startsWith' check. The issue is fixed in version 1.8.1 by using domain anchors ('||') and 'requestDomains' constraints.
Affected products
- Siemens linux-entra-sso < 1.8.1
Timeline
- 2026-04-27: advisory: GitHub Security Advisory published by maintainer
- 2026-05-12: disclosed: CVE published to NVD