Cursor & Windsurf Forked Chromium 94+ N-Day Vulnerabilities
Date: 2025-10
Affected: Cursor & Windsurf Forked Chromium 94+ N-Day Vulnerabilities
Attack vector: rce
Category: real-world
Severity: High

OX Security discovered that Cursor and Windsurf IDEs, built on outdated VS Code forks with stale Electron/Chromium, are exposed to 94+ known CVEs including sandbox escapes. 1.8M developers affected. Both IDEs running Chromium six major versions behind. Forked architecture makes patching structurally difficult and slow.


Mitigations:

Architectural layers (MAESTRO):