Critical Supply Chain Vulnerability Exposed in nDiligence Study

• •All 50 software types studied were found vulnerable, with 46 rated Critical or High risk.
• •Attackers can exploit a single supplier's code to manipulate user interfaces without detection.
• •The vulnerability can lead to disinformation and unauthorized actions in various applications.

nDiligence, Inc. released a four-year study revealing a critical supply chain vulnerability affecting all 50 software and device types examined. The research highlights that 46 of these were rated as Critical or High risk. The vulnerability arises from runtime client-side rendering, allowing attackers to exploit a single supplier to manipulate what users see on their screens. This manipulation can lead to disinformation and unauthorized actions without detection. The study's findings were previously shared with governments for over two years before public disclosure. Notably, an incident involving Polyfill.io in February 2024 demonstrated how such vulnerabilities can persist undetected. The research emphasizes the urgent need for the cybersecurity community to address this issue to protect software integrity across various sectors.