--- title: A Crypto Zero-Day Huntress | daily.dev description: In May 2020, security researcher Amiris Brown and her team at Theta DEVwrks discovered a critical zero-day vulnerability in MetaMask (pre-version 8) that... canonical: https://daily.dev/posts/a-crypto-zero-day-huntress-p5futpphr twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: A Crypto Zero-Day Huntress | daily.dev og:description: In May 2020, security researcher Amiris Brown and her team at Theta DEVwrks discovered a critical zero-day vulnerability in MetaMask (pre-version 8) that... og:url: https://daily.dev/posts/a-crypto-zero-day-huntress-p5futpphr og:image: https://api.daily.dev/og/posts/p5fUTPPhR.png og:image:alt: A Crypto Zero-Day Huntress og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # A Crypto Zero-Day Huntress **[Medium](https://daily.dev/sources/medium_js)** · 62 min read · 1 upvotes · 0 comments ## Summary In May 2020, security researcher Amiris Brown and her team at Theta DEVwrks discovered a critical zero-day vulnerability in MetaMask (pre-version 8) that exposed private keys directly in the browser's DOM. Rather than patching the client-side flaw, Brown rearchitected the entire stack — migrating from ReactJS to a PHP server-side backend using web3.php, implementing ephemeral middleware, CSRF tokens, strict CSP, and nonce-based session management. This defense-in-depth approach predated MetaMask's official sandboxing fix and neutralized supply chain attack vectors later validated by Gal Weizman's LavaMoat analysis. The piece also examines how similar architectural principles could have prevented the Ledger Connect Kit hack and OpenSea XS-Search vulnerability, while arguing that gender homogeneity in offensive security creates systemic blind spots that allow critical vulnerabilities to go undetected. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What was the MetaMask DOM vulnerability before version 8? Versions of MetaMask prior to version 8 exposed private keys directly in the browser's Document Object Model, meaning sensitive key material crossed from a trusted execution context into the untrusted DOM. This created a privilege boundary violation that could let a malicious script steal a user's entire wallet when a transaction was signed. MetaMask patched this DOM leak with the official version 8 release. _Track how wallet extensions like MetaMask evolve their security architecture by following crypto security coverage on daily.dev._ ### How does LavaMoat's Snow library protect MetaMask from sandbox escapes? Snow secures sandboxed JavaScript environments by intercepting and controlling the creation of new window objects, such as those spawned by iframes, using same-origin realms to isolate code execution and block malicious code injection. However, Snow's own GitHub issue 73 acknowledges it cannot defend against certain DOM-based bypasses, particularly ones using data: URIs (per RFC 2397) to spawn nested iframes that escape the sandbox. _Developers hardening browser extensions can follow supply-chain and sandboxing updates like this on daily.dev._ ### How did the Ledger Connect Kit supply chain attack in December 2023 steal funds from crypto wallets? A compromised dependency in the Ledger Connect Kit implementation allowed attackers to inject malicious code that stole roughly $600,000 from users' crypto wallets. Security researchers argue the attack could have been prevented by combining strict dependency pinning with a nonce-based Content Security Policy, since pinning stops malicious code updates from being fetched and CSP blocks unauthorized code from executing even if retrieved. _Follow how supply-chain defenses like dependency pinning and CSP evolve for Web3 tooling on daily.dev._ ## Similar posts on daily.dev - [Evolution of Web3 in Cloud Supply Chain Attacks](https://daily.dev/posts/evolution-of-web3-in-cloud-supply-chain-attacks-3unzi5cdy) · Unit 42 · 0 upvotes · 0 comments - [The 5% Deficit: Defending the Last Frontier of Web3 and Hardware Security](https://daily.dev/posts/the-5-deficit-defending-the-last-frontier-of-web3-and-hardware-security-kp1ep64q4) · Coins Bench · 0 upvotes · 0 comments - [Metamask discloses security incident affecting its infrastructure](https://daily.dev/posts/metamask-discloses-security-incident-affecting-its-infrastructure-fyopvnnja) · BleepingComputer · 0 upvotes · 0 comments - [Web3 wallet tracking & tale of privacy](https://daily.dev/posts/web3-wallet-tracking-tale-of-privacy-wrljzhbbq) · Dev Genius · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#web3](https://daily.dev/tags/web3), [#metamask](https://daily.dev/tags/metamask) [View this post on daily.dev](https://daily.dev/posts/a-crypto-zero-day-huntress-p5futpphr) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"A Crypto Zero-Day Huntress","url":"https://daily.dev/posts/a-crypto-zero-day-huntress-p5futpphr","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/a-crypto-zero-day-huntress-p5futpphr"},"datePublished":"2026-07-24T23:54:03.323Z","dateModified":"2026-09-14T07:15:37.049Z","description":"In May 2020, security researcher Amiris Brown and her team at Theta DEVwrks discovered a critical zero-day vulnerability in MetaMask (pre-version 8) that...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d6ab0a9a223ee01bc82d647f54feb2d2?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d6ab0a9a223ee01bc82d647f54feb2d2?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Medium","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Medium","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium","url":"https://daily.dev/sources/medium_js"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/a-crypto-zero-day-huntress-p5futpphr","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,web3,metamask","timeRequired":"PT62M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Medium","item":"https://daily.dev/sources/medium_js"},{"@type":"ListItem","position":3,"name":"A Crypto Zero-Day Huntress"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/a-crypto-zero-day-huntress-p5futpphr#faq","mainEntity":[{"@type":"Question","name":"What was the MetaMask DOM vulnerability before version 8?","acceptedAnswer":{"@type":"Answer","text":"Versions of MetaMask prior to version 8 exposed private keys directly in the browser's Document Object Model, meaning sensitive key material crossed from a trusted execution context into the untrusted DOM. This created a privilege boundary violation that could let a malicious script steal a user's entire wallet when a transaction was signed. MetaMask patched this DOM leak with the official version 8 release. Track how wallet extensions like MetaMask evolve their security architecture by following crypto security coverage on daily.dev."}},{"@type":"Question","name":"How does LavaMoat's Snow library protect MetaMask from sandbox escapes?","acceptedAnswer":{"@type":"Answer","text":"Snow secures sandboxed JavaScript environments by intercepting and controlling the creation of new window objects, such as those spawned by iframes, using same-origin realms to isolate code execution and block malicious code injection. However, Snow's own GitHub issue 73 acknowledges it cannot defend against certain DOM-based bypasses, particularly ones using data: URIs (per RFC 2397) to spawn nested iframes that escape the sandbox. Developers hardening browser extensions can follow supply-chain and sandboxing updates like this on daily.dev."}},{"@type":"Question","name":"How did the Ledger Connect Kit supply chain attack in December 2023 steal funds from crypto wallets?","acceptedAnswer":{"@type":"Answer","text":"A compromised dependency in the Ledger Connect Kit implementation allowed attackers to inject malicious code that stole roughly $600,000 from users' crypto wallets. Security researchers argue the attack could have been prevented by combining strict dependency pinning with a nonce-based Content Security Policy, since pinning stops malicious code updates from being fetched and CSP blocks unauthorized code from executing even if retrieved. Follow how supply-chain defenses like dependency pinning and CSP evolve for Web3 tooling on daily.dev."}}]} ```