Proton Exploit Official

After researchers disclosed the bug in June 2022, Proton developed and deployed a fix by early July 2022.

Proton maintained its commitment to security through its Responsible Vulnerability Disclosure Policy . Proton Exploit

Shift the tone (e.g., for developers or simpler for general users). After researchers disclosed the bug in June 2022,

When possible, use native desktop or mobile apps which often have different attack surfaces than web-based versions. If you'd like to refine this draft, tell me if you want to: When possible, use native desktop or mobile apps

The attack required a specific sequence of actions to succeed, which limited its real-world viability:

The Sonar Research team identified the vulnerability during a routine audit of Proton's open-source repositories. The issue stemmed from how the web application handled user-controlled HTML. While senders need the ability to style messages, failing to properly sanitize certain tags can allow malicious tags to execute in a reader's browser. How the Exploit Worked