Cryptowallets fixes critical vulnerabilities

MetaMask and Phantom, popular cryptowallets suffered for months from a critical vulnerability in their browser extension plugins.

The vulnerability, dating back to September 2021 and now fixed, put users’ funds at risk as it made it possible for hackers to extract wallet recovery seed phrases stored on computer disks.

No exploits have yet been reported that could be tied to the vulnerability.

Researchers says, the seed phrases generated by wallet providers were being saved on users’ computers in plain text as part of the Restore Session feature. This meant malicious actors could gain entry using malware or physical access.

MetaMask, the most popular web3 wallet on Ethereum, clarified that the critical security issue affected only a “small segment of users” and that the vast majority of users were not at high risk. The MetaMask team added that it already issued mitigations against the vulnerability in its latest update of the wallet’s browser extension.

Phantom, the most-used web3 wallet on the Solana blockchain, said it began issuing fixes in January, three months after the vulnerability was initially flagged by researchers. Phantom plans on rolling out another exhaustive patch next week.

Researchers from Halborn, conducted the research.