Critical SConnect Flaw Enables Drive-By Remote Code Execution
Summary
Researchers say CVE-2026-18397 lets malicious webpages exploit Thales’ SConnect authentication software for remote code execution. Thales patched Chrome and Apple versions and removed the Edge app; SConnect is end of life.
Key points
- SConnect is browser-extension and desktop middleware used with hardware authentication tokens for banking and government systems, including SWIFT-related access.
- The flaw lets malicious webpages or embedded iframes send messages to the extension and exploit an improperly handled RSA-signature check.
- Researchers say a successful attack can load a malicious DLL through SConnect’s native host and achieve remote code execution in seconds.
- Bay Area Labs reported success in about 18% of attempts using AI agents; unsuccessful attempts reportedly produced no visible user alert.
- Thales patched SConnect on the Chrome and Apple app stores in August, removed it from Microsoft Edge in September, and published CVE-2026-18397 on Oct. 1 with a CVSS 4.0 score of 9.4.
- SConnect is end of life. SWIFT introduced Web Connect in September 2025 and has been encouraging corporate customers to migrate, but SConnect may remain as a fallback.
Article Details
- Vulnerability Types
- Improper validation of an RSA signature result using stale buffer contents, enabling signature-check bypass
- Remote code execution through malicious DLL loading by the native host
- Severity
- Critical; CVSS 4.0 score 9.4/10, assigned by Thales Group.
- Exploitation Status
- reported
- Exploit Availability
- claimed_or_private
- Patch Status
- available
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | lowtpills[.]com | Example of a webpage that could send messages to the vulnerable SConnect extension; the article does not identify it as attacker-controlled or malicious infrastructure. |
CVE
People
Vendors
Products
3SKeyTo authenticate to the SWIFT system, you'll need a "3SKey" — a USB security token distributed to partner corporations for their most highly permissioned employees.Fridathis exploit, it was very much agent-driven. The agents had Ghidra to decompile the native host, and then Frida to look at the memory to see what would be successful for the heap spray and what wouldn't."Ghidraeffort. But when I was developing this exploit, it was very much agent-driven. The agents had Ghidra to decompile the native host, and then Frida to look at the memory to see what would be successful forSConnect"SConnect," owned by the Thales Group conglomerate, is one such example of this.Web Connectthey unlocked was SConnect. In September 2025, the SWIFT cooperative introduced a replacement called "Web Connect." It has since been trying to move its corporate customers towards Web Connect, and away from SConnect.
Tools
Fridathis exploit, it was very much agent-driven. The agents had Ghidra to decompile the native host, and then Frida to look at the memory to see what would be successful for the heap spray and what wouldn't."Ghidraeffort. But when I was developing this exploit, it was very much agent-driven. The agents had Ghidra to decompile the native host, and then Frida to look at the memory to see what would be successful for
Countries
Industries
BankingIt's used for authentication to major national government systems — like Qatar's national identity provider, Tawtheeq, and the Swedish Tax Agency, Skatteverket — and various banking and insurance portals.GovernmentResearchers have discovered a critical vulnerability in a hardware authentication program used to access highly sensitive global government and financial systems.InsuranceIt's used for authentication to major national government systems — like Qatar's national identity provider, Tawtheeq, and the Swedish Tax Agency, Skatteverket — and various banking and insurance portals.