As a result, if you have sensitive files in your current workspace and preview a malicious HTML file in the same workspace, the malicious file can easily fetch and exfiltrate the sensitive files. Exploit that exfiltrates local files when a user previews a malicious HTML file with the Live Preview extension If your extension runs a local HTTP server, minimize the risk of DNS rebinding attacks by: Spawning the server on a random port and using the Webview’s portMapping option to map the random localhost port to a static one in the Webview.