This feels like clickbait.
The “bypass” is that it’s malware on the user endpoint, so it just lurks the data using the user’s existing session. So it’s not a flaw with Gmail or limited to that platform.
The “bypass” is that it’s malware on the user endpoint, so it just lurks the data using the user’s existing session. So it’s not a flaw with Gmail or limited to that platform.