1-Click GitHub Token Stealing via a VSCode Bug

# Summary A vulnerability in VSCode's browser-based editor (github.dev) allowed attackers to steal GitHub OAuth tokens through a simple link click. The flaw exploited VSCode's webview sandboxing mechanism, which uses cross-origin iframes and the postMessage API to communicate between isolated components, enabling an attacker to exfiltrate a token with full repository access. The stolen token grants read and write permissions across all repositories a user has access to, including private ones.