According to researchers from the CERT Coordination Center (CERT/CC) at Carnegie Mellon University, AVG Secure Search, a browser toolbar from antivirus vendor AVG Technologies that’s supposed to protect users from malicious websites, could have allowed remote attackers to execute malicious code on computers.

AVG SafeGuard installs an ActiveX control called ScriptHelperApi in Internet Explorer that exposes sensitive functionality to websites.

Will Dormann, a vulnerability analyst at CERT/CC said: “This control does not internally enforce any restrictions on which sites may invoke its methods, such as by using the SiteLock template. This means that any website can invoke the methods exposed by the ScriptHelper ActiveX control.”

ScriptHelper is automatically placed on a list of pre-approved ActiveX controls in the system registry which bypasses the security feature in IE that requires permission to run ActiveX.

Users should make sure that they download and install the latest version if they intend to keep using it. They are versions AVG Secure Search 18.1.7.598 and AVG Safeguard 18.1.7.644.

“Free software isn’t always free,” Dormann warned.