Cursor, Windsurf IDEs riddled with 94 n-day Chromium vulnerabilities (www.bleepingcomputer.com)

Researchers at Ox Security found that Cursor and Windsurf—AI-powered IDEs forked from VS Code and distributed as Electron apps—ship with outdated Chromium and V8 builds that expose users to at least 94 known, already-patched n-day vulnerabilities. Together the two editors reach roughly 1.8 million developers. Ox demonstrated a working proof-of-concept exploit for the Maglev JIT integer overflow (CVE-2025-7656, patched July 15, 2025) that crashes Cursor via a deeplink-hosted JavaScript payload; the team warns this class of flaws can enable far worse outcomes, including memory corruption and arbitrary code execution, not just denial-of-service. Technically, the root cause is Electron’s bundling of specific Chromium+V8 versions: if an IDE vendor doesn’t update Electron (or the forked VS Code), all subsequent Chromium fixes remain absent, creating a long-lived attack surface. Ox details multiple realistic attack vectors—malicious extensions, poisoned documentation/README previews, deeplinks, or phishing—that could deliver exploits. Cursor dismissed the report as “out of scope” for self-inflicted DoS and Windsurf didn’t respond. The practical takeaway for the AI/ML community: avoid stale Electron-based tools, demand timely upstream security updates (or use the latest VS Code, which receives regular Chromium/V8 patches), and treat IDE content previews and extensions as high-risk vectors.