nDiligence Study Finds Supply Chain Risk Across 50 Platforms

nDiligence has published Attack the Glass (ATG), a four-year study that identifies a critical supply-chain vulnerability affecting 50 platform types, with 46 rated Critical or High risk. The research explains that many software products—ranging from web browsers and mobile apps to vehicle displays, medical devices and industrial control screens—construct their user interfaces from code and data loaded at runtime on the device.

This runtime client-side rendering relies on numerous suppliers, meaning an attacker who compromises any one supplier can gain a foothold inside the running application, potentially altering what a user sees, capturing keystrokes and acting with the user’s authority even after security checks have passed.

The study highlights concrete evidence of the risk by recounting the February 2024 compromise of the Polyfill[.]io domain, used by more than 100,000 websites. The altered code ran on visitors’ devices for months before researchers detected it in June, and the underlying vulnerability was never fixed. ATG details five attacker aims across ten effect categories: deceive, disrupt, degrade, deny and destroy.

The research team notes the broader implications for disinformation on news and election sites, misrepresentation to commanders and grid operators, and masking safety alerts for targeted users. The findings have been briefing governments privately for more than two years, and the team offers free access to a sixteen-chapter whitepaper, demonstrations and remediation playbooks under Traffic Light Protocol CLEAR.

Beckett, founder and CEO of nDiligence, stresses that ATG enables covert manipulation of trusted screens and calls for understanding to protect critical software ecosystems.