The SConnect extension and its native host, used by over one million users for secure authentication with hardware tokens like 3SKeys, suffer from a critical remote code execution vulnerability (CVE-2026-18397). This vulnerability is due to a poor, custom implementation of RSA-2048 token validation that fails to properly initialize memory, allowing attackers to bypass validation and load arbitrary DLL plugins silently. This can be triggered by any website or iframe visited by the user, effectively enabling drive-by code execution. The affected version is 2.16.0.0 of both the extension and native host. The CVSS score of 9.4 reflects the high impact and exploitability of this vulnerability.

Successful exploitation allows an attacker to execute arbitrary code on the victim's machine by silently downloading and loading malicious DLLs through the vulnerable extension and native host. This compromises the security of authentication tokens and potentially the entire system, posing a severe risk to users relying on SConnect for secure hardware token authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users and administrators should monitor official channels for updates or patches addressing CVE-2026-18397. Until a fix is available, consider disabling or uninstalling the vulnerable extension version 2.16.0.0 and its native host to prevent exploitation.