Oneconsult on the File System Access API: after two clicks a website holds read and write access to folders such as .vscode, .Azure, the public desktop and SMB shares in Chrome and Edge, enough for token theft and persistence without a process on the host

Oneconsult analyses, from the Chromium source and tests on Windows 11 with Chrome and Edge 150.0.7871.101, what a website can reach through the File System Access API once a user selects a folder and grants permission: the handle stays valid as long as the tab is open and is obtained after just two user clicks (Oneconsult, 2026-11-02). Chrome rejects blocklisted paths, but a path that is not in its table and not an ancestor of a blocked path is allowed, and the kDontBlockChildren rule leaves the subfolders of listed directories selectable; Oneconsult confirmed .vscode, the Azure token cache, C:\Users\Public and SMB shares as accessible (Oneconsult, 2026-11-02).

Oneconsult demonstrates these paths. A site can search a granted folder and take files such as cached Azure tokens and .env files. It can drop a fake VS Code extension into .vscode/extensions, which runs inside the normal code.exe process and is unaffected by Mark of the Web because Node.js does not check the Zone.Identifier stream. It can plant PowerShell profile and module backdoors, which work only with the Bypass or Unrestricted execution policy because the API stamps every written file with ZoneId=3 and RemoteSigned refuses such files. It can drop files on the public desktop, where they appear for all users and trigger a warning that a certain percentage of users acknowledge. And it can run an interactive file proxy through the still-open tab, where EDR sees only the browser reading and writing files (Oneconsult, 2026-11-02). A OneDrive Known Folder Move enabled while Chrome is running leaves a stale blocklist, so the redirected Desktop was writable; Oneconsult notes that the bypass has been reported to Google, which made the issue public, and that Google classed reading a single dragged file from a blocked folder as "not a security issue" (Oneconsult, 2026-11-02).

Daniel Oz's July write-up of the same technique has a website edit a file the user already holds. He says the user-gesture requirement does not prevent phishing, only automatic picker invocation, and that signed or complex files may fail, be blocked or break in a way that prevents execution (Oz, 2026-07-05).

Triage: browsers legitimately read and write files for web editors such as Google Docs and VS Code for Web, as Oneconsult notes; the signal is a browser process writing into a persistence location, not the file activity itself.