Your Nostr private nsec key could have been exposed simply by visiting a website. 😱
I recently found and privately disclosed a high-impact vulnerability in Flamingo, a Nostr browser extension similar to nos2x and Alby that lets websites request your public key and ask you to sign Nostr events without handing every site your private key.
While reviewing the code, I noticed that Flamingo’s webpage-to-extension message bridge was too permissive. A normal webpage could reach an internal extension method that should only have been available to Flamingo itself, allowing the page to export the stored nsec.
The maintainer responded quickly and shipped a fix in v0.1.1. Page-originated calls are now restricted to the intended public NIP-07 methods, while sensitive extension-only methods are blocked from websites.
If you use Flamingo, make sure you are updated to v0.1.1.
Proud to have helped catch this before it could do real damage, and shoutout to the maintainer for handling the report quickly and cleanly.
dzlandis
npub18z…fffdd
2026-06-11 11:14:38 UTC
Author Public Key
npub18zs9fsm4zkacu0k4dumnnpnxq62kjcfva8aekft0m0jynmfrvs4qafffddPublished at
2026-06-11 11:14:38 UTCEvent JSON
{
"id": "de2d5c852c5ba6b941c3ca62b98b3f5b27face2b296512039aefbba3ca1498d7",
"pubkey": "38a054c37515bb8e3ed56f37398666069569612ce9fb9b256fdbe449ed23642a",
"created_at": 1781176478,
"kind": 1,
"tags": [
[
"r",
"wss://relay.damus.io/",
"write"
],
[
"r",
"wss://nostr.wine/",
"write"
],
[
"r",
"wss://nos.lol/",
"write"
],
[
"r",
"wss://relay.snort.social/",
"write"
],
[
"imeta",
"url https://blossom.primal.net/ef8b7df82b79fa4fbc742441fd678ae67e50f37d2041f3fc2dc2a5a62b7a3f03.mp4",
"m video/mp4",
"dim 1080x1920",
"duration 23",
"bitrate 992012.5217391305",
"service nip96"
],
[
"client",
"Primal Web"
]
],
"content": "Your Nostr private nsec key could have been exposed simply by visiting a website. 😱 \n\nI recently found and privately disclosed a high-impact vulnerability in Flamingo, a Nostr browser extension similar to nos2x and Alby that lets websites request your public key and ask you to sign Nostr events without handing every site your private key.\n\nWhile reviewing the code, I noticed that Flamingo’s webpage-to-extension message bridge was too permissive. A normal webpage could reach an internal extension method that should only have been available to Flamingo itself, allowing the page to export the stored nsec.\n\nThe maintainer responded quickly and shipped a fix in v0.1.1. Page-originated calls are now restricted to the intended public NIP-07 methods, while sensitive extension-only methods are blocked from websites.\n\nIf you use Flamingo, make sure you are updated to v0.1.1.\n\nProud to have helped catch this before it could do real damage, and shoutout to the maintainer for handling the report quickly and cleanly.\n\nhttps://blossom.primal.net/ef8b7df82b79fa4fbc742441fd678ae67e50f37d2041f3fc2dc2a5a62b7a3f03.mp4 ",
"sig": "21cfd8e9bab14082902d0d2815fad67910caa4e5dae88064f1641a181b8d77a197e4118bba608aab161841606e93564fae96896c5a944adcf3670706b10a92a8"
}