More detailed information on the security issues fixed in Orion release notes?

stonekyx

The release notes of Orion Beta 0.99.137 - Oct 24, 2025 included a few security issues being fixed, like the ones below (texts quoted as-is):

Permission allow through space bar and enter permission escalate vuln in orion mac os
Permissionjacking on Mac orion browser

These sound worrying to me, especially when it feels that the person who wrote them didn't even bother explaining what is "Permissionjacking" and hastily shortened words like "vuln". What was the potential impact of these security issues? Where were they originally reported? In what situation could these vulnerabilities have been exploited? Please kindly provide more information if you have.

astruckm

stonekyx Thank you for relaying your concerns about this issue.

Such security fixes generally come about from us getting contacted through our Bug Bounty Program: https://help.kagi.com/kagi/privacy/bug-bounty-program.html .

Those particular patches mitigated some edge case attacks a malicious site could have used to gain permission to system AV capabilities (i.e. the permissions a site like Google Meet or Zoom will ask for legitimately). We don't know of any users having been affected by this previously, but adding security patches like these are a regular part of our development work.