CVE-2023-40580
📋 TL;DR
This vulnerability allows malicious websites to access the recovery mnemonic phrase when the Freighter Stellar wallet browser extension is unlocked. It affects users of the Freighter extension who visit compromised or malicious websites while their wallet is unlocked. The vulnerability represents a critical information disclosure risk for cryptocurrency wallet users.
💻 Affected Systems
- Freighter Stellar Wallet Chrome Extension
📦 What is this software?
Freighter by Stellar
⚠️ Risk & Real-World Impact
Worst Case
Complete loss of all cryptocurrency assets stored in the Freighter wallet as attackers can steal the mnemonic phrase and gain full control over the wallet and funds.
Likely Case
Attackers create malicious websites that exploit this vulnerability to steal mnemonic phrases from users who visit while their Freighter wallet is unlocked, leading to asset theft.
If Mitigated
With proper patching, the vulnerability is eliminated, preventing unauthorized access to mnemonic phrases even when visiting malicious websites.
🎯 Exploit Status
Exploitation requires users to visit a malicious website while Freighter is unlocked, making social engineering a likely component.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.3.1
Vendor Advisory: https://github.com/stellar/freighter/security/advisories/GHSA-vqr6-hwg2-775w
Restart Required: No
Instructions:
1. Open Chrome browser. 2. Go to chrome://extensions/. 3. Find Freighter extension. 4. Click 'Update' or manually update to version 5.3.1 or later. 5. Ensure the extension shows version 5.3.1 or higher.
🔧 Temporary Workarounds
Lock Freighter When Not Actively Using
allManually lock the Freighter wallet extension when not actively performing transactions to prevent exploitation.
Click Freighter extension icon, select 'Lock' option
Disable Extension Temporarily
allTemporarily disable the Freighter extension until patched to eliminate the attack surface.
chrome://extensions/ → Toggle Freighter extension to 'Off'
🧯 If You Can't Patch
- Disable the Freighter extension completely until patching is possible
- Use Freighter only in a dedicated browser profile with no web browsing activity
🔍 How to Verify
Check if Vulnerable:
Check Freighter extension version in Chrome: chrome://extensions/ → Find Freighter → Check version numberCheck Version:
chrome://extensions/Verify Fix Applied:
Confirm extension version is 5.3.1 or higher in chrome://extensions/📡 Detection & Monitoring
Log Indicators:
- Unusual extension activity logs, unexpected mnemonic phrase access attempts
Network Indicators:
- Requests from browser to unknown domains while Freighter is active
SIEM Query:
Browser extension logs showing Freighter activity followed by external network connections🔗 References
- https://github.com/stellar/freighter/commit/81f78ba008c41ce631a3d0f9e4449f4bbd90baee
- https://github.com/stellar/freighter/pull/948
- https://github.com/stellar/freighter/security/advisories/GHSA-vqr6-hwg2-775w
- https://github.com/stellar/freighter/commit/81f78ba008c41ce631a3d0f9e4449f4bbd90baee
- https://github.com/stellar/freighter/pull/948
- https://github.com/stellar/freighter/security/advisories/GHSA-vqr6-hwg2-775w
