A Browser-Based VSCode Token Theft Chain

How a webview input-handling flaw turned a single click into GitHub token exposure in 2026