nDiligence Releases Four-Year Study Identifying a Critical Supply-Chain Vulnerability Across 50 Platform Types
nDiligence study finds 50 platform types vulnerable to runtime client-side rendering exploits.
A four-year study by nDiligence, called Attack the Glass (ATG), has identified a critical supply-chain vulnerability affecting 50 types of software and devices. This vulnerability allows attackers to manipulate what users see on their screens and how applications function after all security checks have passed, by compromising any one of the numerous suppliers involved in runtime client-side rendering. The research highlights that existing security measures like sign-in, encryption, and firewalls do not prevent these attacks, and the underlying vulnerability remains unfixed.
AI summary of the linked source. Not reviewed by an editor. How this works
Run nDiligence?
Get an email when a new story names nDiligence, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA four-year study revealed that attackers can compromise any of the many third-party suppliers involved in runtime client-side rendering to manipulate what users see and how applications behave — after authentication, encryption, and firewall checks have already passed. This matters because organizations typically trust that their security perimeter protects the end-user experience, yet the attack surface extends across dozens of upstream software and device vendors they do not directly control. The vulnerability remains unpatched across 50 platform types, meaning every organization relying on these platforms is currently exposed. Traditional defenses are simply not designed to detect or prevent manipulation at the rendering layer, leaving a systemic blind spot in modern security architectures.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — Polyfill.io