This post informs users of a bug in the Mist Browser Beta, a post on the ethereum blog that may allow theft of private keys by malicious websites; This vulnerability affects the Mist Browser Beta v0.9.3 and below.
A security alert was highlighted by the misty team published today on the ethereum blog that security update discrepancies in Mist, its built-in platform electron and Chromium browser data can compromise with privacy warnings:
Due to the chromium vulnerability that affects all release versions of the Mist Browser Beta v0.9.3 and below, they are issuing these warning users, not currently browsing the untrusted websites with the mist browser beta.
Although they note that users of the Ethereum Wallet Desktop app are not affected, this period has the following security issues related to High Profile ethereum, especially the infamous hack of parity and the contingency quarantine of funds, their commitment to keep developers at the top of new problems curiously anxious to highlight.
Its compound has a three-level setup in the mist; electron and this Chromium still presents’ obstacles for safety. This security alert in the Mist team explains the complications that the reason tells vulnerability:
This is a major problem with the existing architecture that many patch-steps are removed from any 0-day chromium vulnerability mist: the first Chromium needs to be compromised, and then the electron needs to update the Chromium version. And finally, the mist needs to be updated on the new electron version
It is advisable to follow the seven-step checklist to ensure maximum security to the haze browser users: Avoid placing large amounts of ether or tokens in the private key on its online computer. Back up your personal key, and do not go to untrusted websites with this mist. Do not use Mist on this incredible network, keep your day-to-day browser up-to-date and keep track of your operating system and anti-virus updates and learn how to verify file checksums.
source - https://cointelegraph.com/news/security-alert-mist-browser-bug-puts-private-keys-in-danger