Evernote makes products that are the go-to apps for millions of people worldwide accomplishing their most important work. It's important to us that your experience be both private and secure. We proactively test our products for security issues and regularly squash bugs that could create vulnerabilities in our apps.
Get the Evernote Web Clipper Clip web pages as you browse. Keep them all in Evernote, where they’ll sync to all your devices. Evernote Web Clipper. Use the Evernote extension to save things you see on the web into your Evernote account. Goodbye, bookmarks. Hello, Web Clipper! Clip the web pages you want to keep. Save them in Evernote. Easily find them on any device. CLIP IT ALL - Great for research—clip any article or web page - Clip to a specific notebook.
Here you'll find a list of the most recent security bugs that we've fixed. We'll update this page anytime we release an app that has a security update. (Note: Reporting began on March 1st, 2015. Fixes released prior to this date do not appear.)
To stay up-to-date with security patches, check back here or in our app release notes.
Evernote for Mac
| Ticket Id | Description | Fixed Release |
|---|---|---|
| MACOSNOTE-28956 | Added com.apple.quarantine attribute to attachment files to prevent potential one click execution. | Evernote for Mac 7.13 GA |
| MACOSNOTE-28914 | Fixed a potential dylib hijacking issue. | Evernote for Mac 7.12 GA |
| MACOSNOTE-28840 | Fixed a regression and added the prompt before opening any file:// URIs. | Evernote for Mac 7.10 Beta 1 and 7.9.1 GA |
| MACOSNOTE-28634 | Fixed a local file path traversal issue on attachment previewing. | Evernote for Mac 7.6 |
| MACOSNOTE-12400 | Added a prompt before opening any file:// URIs. | Evernote for Mac 6.6 |
| MACOSNOTE-18729 | Improved NSConnection usage with NSProtocolChecker to protect the cross application IPC channel. | Evernote for Mac 6.3 |
Evernote for Windows
| Ticket Id | Description | Fixed Release |
|---|---|---|
| WINNOTE-20063 | Fixed a stored cross site scripting (XSS) vulnerability in modified external web links. | Evernote for Windows 6.19 GA |
| WINNOTE-19941 | Fixed a vulnerability in the protocol handler, specifically Evernote client installed on Windows 10, 7 or 2008 can be tricked in arbitrary command execution if the user clicks on a specially crafted URL. | Evernote for Windows 6.18 beta 2 and 6.17.7 GA |
| WINNOTE-19568, WINNOTE-19620 | Fixed a stored cross site scripting (XSS) issue in rendering attachment filenames. | Evernote for Windows 6.16 beta 1 and 6.16 GA |
| WINNOTE-19377 | Improved security by always generating HTTPS URLs to Evernote services. | Evernote for Windows 6.15 beta 1 and 6.15 GA |
| WINNOTE-19299 | Fixed an issue in versions 6.4 - 6.7 where the app would send authentication tokens over HTTP when contacting certain portions of the Evernote Service. The vulnerability did not affect note content, usernames, or passwords and those continued to be securely encrypted in transit. | Evernote for Windows versions 6.7.6 (Hotfix) and 6.8.6 (First GA release) |
| WINNOTE-15870 | Fixed a potential stored cross site scripting (XSS) issue on Google Drive integration. | Evernote for Windows 6.4 |
| WINNOTE-15637, WINNOTE-8970 | Fixed DLL hijacking/preloading vulnerabilities on installer and other binaries. | Evernote for Windows 6.3 |
| WINNOTE-14610 | Delete the local data in the original folder when the local folder configuration is changed. | Evernote for Windows 6.1.2 |
| WINNOTE-13340, WINNOTE-13475, WINNOTE-13472 | Fixed several stored XSS (cross-site scripting) issues in activity view and other web views. | Evernote for Windows 5.9.5 |
| WINNOTE-8997 | Added a warning to users before opening local files. | Evernote for Windows 5.8.11 |
| CE-735 | Fixed a stored XSS (cross-site scripting) issue in Related Context by properly rendering the context note snippet. | Evernote for Windows 5.8.4 |
Evernote for iOS
| Ticket Id | Description | Fixed Release |
|---|---|---|
| IOSNOTE-27747 | Fixed an issue that saved screenshot might show up prior to PIN lock screen for a short time period. | Evernote for iOS 8.16 |
| IOSNOTE-28074 | Fixed a PIN lock bypass issue. | Evernote for iOS 8.2 |
| IOSNOTE-22342 | Updated the keychain items accessibility attribute in iTunes/iCloud backups. | Evernote for iOS 7.14 |
| IOSNOTE-19688, CP-3280 | Fixed the WebViews that disables same-origin policy using file:// URLs. | Evernote for iOS 7.7.7 |
| IOSNOTE-19338 | Upgraded vulnerable SDWebImage library to 3.7.2. | Evernote for iOS 7.7.2 |
Evernote for Android
| Ticket Id | Description | Fixed Release |
|---|---|---|
| DRDNOTE-30711 | Fixed an issue where certain third party content providers were identified by their package names rather than package signatures. | Evernote for Android 8.12.2 |
| DRDNOTE-31085 | Fixed an issue where the Widget4x1SettingsActivity/Widget4x2SettingsActivity activities may be exploited through a malicious Intent. | Evernote for Android 8.12.2 |
| DRDNOTE-31086 | Fixed an issue where the NewPhoneMainActivity activity may be exploited through a malicious Intent. | Evernote for Android 8.12.2 |
| DRDNOTE-31087 | Fixed an issue where the ContractNoUiActivity activity may be exploited through a malicious Intent. | Evernote for Android 8.12.2 |
| DRDNOTE-31088 | Fixed an issue where the URIBrokerActivity activity may be exploited through a malicious Intent. | Evernote for Android 8.12.2 |
| DRDNOTE-31089 | Fixed an issue where the AuthorizeThirdPartyAppActivity activity may be exploited through malicious Intent. | Evernote for Android 8.12.2 |
| DRDNOTE-31090 | Fixed an issue where the ClipActivity activity may be exploited through malicious Intent. | Evernote for Android 8.12.2 |
| DRDNOTE-31033 | Fixed an issue in an exported Activity that might be exploited through malicious Intent. | Evernote for Android 8.12 |
| DRDNOTE-30932 | Fixed a PIN lock bypass issue in Android's Google Search integration. | Evernote for Android 8.11 |
| DRDNOTE-30589, DRDNOTE-30753 | Fixed a PIN lock bypass issue. | Evernote for Android 8.9 |
| DRDNOTE-24142 | Fixed a PIN lock bruteforcing issue. | Evernote for Android 7.9.9 |
| DRDNOTE-23054 | Fixed a potential stored cross site scripting (XSS) issue on Google Drive integration. | Evernote for Android 7.9.5 |
| DRDNOTE-20794, DRDNOTE-22660 | Fixed a PIN lock bypass issue. | Evernote for Android 7.9.4 |
| DRDNOTE-20842 | Fixed an issue that some WebView could ignore SSL certificate errors in debug/internal builds. | Evernote for Android 7.6 |
| DRDNOTE-9500, DRDNOTE-11183 | Move notes stored in SD card to internal memory. | Evernote for Android 7.0.7 |
Evernote for BlackBerry
| Ticket Id | Description | Fixed Release |
|---|---|---|
| EFB-1836 | Fixed an issue that PIN lock can be bypassed. | Evernote for BlackBerry 5.6.2 |
Web Clipper 7 for Chrome
| Ticket Id | Description | Fixed Release |
|---|---|---|
| CLIPPER-2673 | Fixed several issues by validating events, adding clickjacking protection and etc. | Evernote Clipper 7 for Chrome 7.12.2.1 |
| CLIPPER-2582 | Fixed an issue that could cause browser's same origin policy to be bypassed. | Web Clipper 7 for Chrome 7.11.1 |
| CLIPPER-1371 | Fixed an issue regarding automated notebook suggestions. | Web Clipper 7 for Chrome 7.2.1 |
Web Clipper 6 for Chrome
| Ticket Id | Description | Fixed Release |
|---|---|---|
| CC-3860 | Fixed a potential cross site scripting (XSS) issue. | Web Clipper 6 for Chrome 6.13.2 |
| CC-2561 | Fixed a potential cross site scripting (XSS) issue while clipping from a malicious site. | Web Clipper 6 for Chrome 6.9.2 |
| CC-1729 | Fixed a potential HTML injection issue through the extension's login page. | Web Clipper 6 for Chrome 6.7 |
| CC-1693 | Fixed a potential stored cross site scripting (XSS) issue in releated search results. | Web Clipper 6 for Chrome 6.6 |
Web Clipper 6 for Safari
| Ticket Id | Description | Fixed Release |
|---|---|---|
| CC-3860 | Fixed a potential cross site scripting (XSS) issue. | Web Clipper 6 for Safari 6.13.2 |
| SAFARICLIP-992 | Fixed a potential stored cross site scripting (XSS) issue in releated search results. | Web Clipper 6 for Safari 6.7 |
Penultimate for iOS
| Ticket Id | Description | Fixed Release |
|---|---|---|
| IOSPENULT-4056 | Updated adonit SDK to fetch all web content through HTTPS. | Penultimate for iPad 6.2 |
Evernote Food for iOS
| Ticket Id | Description | Fixed Release |
|---|---|---|
| IOSFOOD-4320 | Upgraded vulnerable SDWebImage library to 3.7.2. | Evernote Food for iOS 2.5.1 |
| We have ended support for this product and will not be providing any future security updates. | September 30, 2015 |
Skitch for iOS
| Ticket Id | Description | Fixed Release |
|---|---|---|
| We have ended support for this product and will not be providing any future security updates. | January 22, 2016 |
Skitch for Android
| Ticket Id | Description | Fixed Release |
|---|---|---|
| We have ended support for this product and will not be providing any future security updates. | January 22, 2016 |
Skitch for Windows Touch
| Ticket Id | Description | Fixed Release |
|---|---|---|
| We have ended support for this product and will not be providing any future security updates. | January 22, 2016 |
Skitch for Windows
| Ticket Id | Description | Fixed Release |
|---|---|---|
| We have ended support for this product and will not be providing any future security updates. | January 22, 2016 |
Evernote Clearly
| Ticket Id | Description | Fixed Release |
|---|---|---|
| We have ended support for this product and will not be providing any future security updates. | January 22, 2016 |
Evernote for Pebble
| Ticket Id | Description | Fixed Release |
|---|---|---|
| We have ended support for this product and will not be providing any future security updates. | January 22, 2016 |
Anyone who has done just about anything on the internet has at some point been overwhelmed with the stampede of open tabs from blogs, news articles, social media sites, and the like that feel too important to close but not urgent enough to read. Bookmarking them would only delay the inevitable. The deluge of web pages would make the bookmarks manager just as impenetrable as the tabs were.
Evernote’s web clipper promises to create a home for those tabs. An extension for Chrome, Safari, Firefox, Opera, and Microsoft Edge, and Internet Explorer, it allows you to quickly and easily save any webpage to a notebook in Evernote. The web clipper is unlike the cruder methods of saving webpages that exist in those browsers natively. It extracts data like images and comments and converts them into a readable format.
What’s more, saving clips rather than racking up bookmarks or cobbling together pdfs will help streamline the pages you save. It will strip away ads that otherwise crowd the space and keep formatting as simple as you need it to be.
How to Install the Evernote Web Clipper
Installing the web clipper is fairly simple. Navigate to evernote.com/features. There, under the “features” dropdown menu, click the web clipper icon. On the web clipper’s page, click the “get web clipper,” which will route you over to the app store that matches your browser. Depending on which browser that is, the store page will show you a “get” or “add to chrome” button or something of the sort. Once you step through the store’s process, you’ll be ready to start clipping webpages.
With the extension installed, clipping a page is a simple matter of clicking the green elephant icon in the upper right. That icon will bring up a menu with a “save clip” button that will make a new clip from either the whole page or a block of selected text.
How to Clip in Article Format
Clips come in many shapes and sizes. Depending on what sort of webpages you’re saving and what you plan on using them for, you will want to save different bits of information. Using the web clipper’s various options allows you to fine tune the structure of a clip to meet your specific needs.
When you click on the web clipper icon, it will pull up a menu of choices on how to save the page you’re looking at.
The article format is the most straightforward variety of clip the extension provides. It includes a balanced set of information that will tend to work for the broadest range of cases. Saving a page as an article will extract graphics and main text. Saving clips that way gives you a version that looks mostly like the original.
That recipe you saved from a food blog will keep the step-by-step instructions as well as visual guides and menus of other entries you might want to explore later.
The article format, of course, does not look entirely like the original webpage. The web clipper will hone in on highlighted text to make busy pages readable.
Opting for a simplified article will yield something cleaner than the regular article format. To change the clip format, click one of the alternatives underneath “article” in the “save clip” menu. Article should be selected by default.
As with the article format, the web clipper will extract text and images for a simplified article. The simplified article format, though, will also cut out ads and menus as well as reducing text formatting to its simplest form.
Saving a clip this way would serve you better if you wanted to save a news article without carrying over menus to subscribe to various magazines or visit sponsors’ websites.
How to Save Full Pages
Alternatively, you may need to scoop up as much information as possible from a web page. In that case, the full page option will better suit your needs. On this setting, Evernote grabs not just text images but items like headers, footers, and sidebars as well.
You might want to see the chat sidebar attached to a particular article to document what other users are saying or take a look at what gets weeded out by moderators and what does not. This option still gives you the advantages over a regular bookmark that the other settings do. You won’t need to worry about moved or delete pages. You can access the clips you save even when you’re offline.
The full page format, however, gives you just about all the information that you would get from visiting the web page itself. If you’re looking to save more than just the core content of a page, taking a full page clip will suit you better than the other options.
How to use Evernote Bookmarks
In some cases, extracting information from a page will not be what you want. You could be interested in digging through the archives of a blog. You might want to return to a store page to buy an item you found or look for similar deals. Here, only something akin to a bookmark will do.
Of course, regular bookmarks are still rife with inconvenience once you build up too many. They are usually unwieldy to search. It is usually difficult to attach any sort of context to them so you can remember why you saved any particular one in the first place.
The web clipper’s bookmark format solves both these problems at once. The name can be deceptive. While an Evernote bookmark performs the same basic function as a traditional one, it adds extra features to keep the pages you saved organized. Being saved in Evernote rather than in a browser, this sort of bookmark is searchable and taggable, making it easier to find later.
Evernote also tacks on an image from the site and text from its meta description. Having that extra tidbit of information can help you keep track of what each bookmark is for. When you finally do have time to dig back through all the pages you’ve saved, you can map each one to the project or task you originally associated it with. With either a chain of open tabs or a pile of context-free bookmarks, that information can easily get lost in the shuffle.
How to Use Evernote Screenshots
Sometimes what you want to save will not be core information on a page or the menus to navigate elsewhere. You might want to document exactly what a particular dialogue showed at the precise time that you viewed it or document a step-by-step process to use a particular web app.
In those cases, clipping in the article or full page format would only get you part of the way there. What you really need is a screenshot. The Evernote web clipper’s screenshot format takes everything valuable about a traditional screenshot and adds a host of additional features.
When you save a page this way, the web clipper provides crosshairs you can click and drag to select a particular area to include in your screenshot. Once you’ve marked out the par of the screen you want to save, it provides a set of markup tools to highlight the most important tidbits.
You can highlight the timestamp on a busy page to remind the viewer that it’s important. You can add arrows to point out key elements of the page’s UI. You can pixelate sensitive information. You might, for instance, want to show posts on social media from a particular point in time without revealing the names and faces of the people who wrote them.
Saving screenshots to Evernote makes them easier to organize than the conventional variety. Tagging and searching frees you from stitching together directory trees from scratch to remind yourself which screenshot goes where.
Three Tricks to Maximize Efficiency
1. Use Tag and Search to Keep Track of Clips
Once you save a clip, Evernote lets you slot it into a notebook. Not only does that feature keep all your clips in one place, but it makes them easier to access after the fact. You can add tags and comments to specific clips or notebooks. You can use Evernote’s powerful search tools to find clips easily. You can highlight and annotate text and images in the clips you save.
2. Share Clips with Your Team
You can share and email clips, as well as create unique URLs to let other people view your clips. This way, you can cut down on redundancy. If everyone on the team should see that article saved to your notebook, using a custom URL will mean fewer messages to chase down as you share.
3.Integrate the Web Clipper with Other Apps
On top of its general formats, the Evernote web clipper is smart enough to tailor-make clips from specific applications. On services like Youtube and Linkedin, the web clipper will add a special option to its raft of formats. What information you want from a Linkedin page might be similar to what you want from a news article and it might not. Having a purpose-built tool to read a Linkedin page means you don’t need to rely on trial and error to find the settings that mesh with it.
A Force Multiplier for Memory
A tool like the web clipper is a natural fit with the founding vision of Evernote. The app was originally intended as a tool to multiply users’ memory. By providing a fast and intuitive way to collect and compile notes, Evernote promised to turn the average person into the cocktail party savant who remembers the name of each and every person she meets.
Evernote Clipper Safari
Nowhere is the cause of extended memory more critical than in the information monsoon of the modern internet. Recalling why you decided to suspend each and every one of those open tabs quickly becomes practically impossible. The Evernote web clipper helps remind you not just what information was contained in those tabs but why it mattered to you in the first place.