Search

Find a vulnerability

Search criteria

    2 vulnerabilities by extension.vn

    CVE-2026-82810 (GCVE-0-2026-82810)

    Vulnerability from nvd – Published: 2026-08-31 16:45 – Updated: 2026-08-31 16:45
    VLAI
    Title
    extension.vn 2FA Authenticator Extension Background Service Worker chrome.runtime.onMessageExternal.addListener information disclosure
    Summary
    A weakness has been identified in extension.vn 2FA Authenticator Extension 1.0.0.2 on Chrome. The impacted element is the function chrome.runtime.onMessageExternal.addListener of the component Background Service Worker. Executing a manipulation of the argument sender.id can lead to information disclosure. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.
    Severity
    4.8 (Medium)
    CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
    3.3 (Low)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
    3.3 (Low)
    CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
    CWE
    Assigner
    References
    URL Tags
    https://vuldb.com/vuln/397229 vdb-entrytechnical-description
    https://vuldb.com/vuln/397229/cti signaturepermissions-required
    https://vuldb.com/cve/CVE-2026-82810 third-party-advisory
    https://vuldb.com/submit/875249 third-party-advisory
    https://github.com/xryj920/chrome_extensions/blob… exploit
    Impacted products
    Vendor Product Version
    extension.vn 2FA Authenticator Extension Affected: 1.0.0.2
        cpe:2.3:a:extension.vn:2fa_authenticator_extension:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    DRXYJ (VulDB User) VulDB CNA Team
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:extension.vn:2fa_authenticator_extension:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Background Service Worker"
          ],
          "product": "2FA Authenticator Extension",
          "vendor": "extension.vn",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0.2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "DRXYJ (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A weakness has been identified in extension.vn 2FA Authenticator Extension 1.0.0.2 on Chrome. The impacted element is the function chrome.runtime.onMessageExternal.addListener of the component Background Service Worker. Executing a manipulation of the argument sender.id can lead to information disclosure. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 1.7,
            "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "Information Disclosure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "Improper Access Controls",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T16:45:09.367Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-397229 | extension.vn 2FA Authenticator Extension Background Service Worker chrome.runtime.onMessageExternal.addListener information disclosure",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/397229"
        },
        {
          "name": "VDB-397229 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/397229/cti"
        },
        {
          "name": "CVE-2026-82810 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-82810"
        },
        {
          "name": "Submit #875249 | extension.vn 2FA Authenticator Chrome extension 1.0.0.2 Information Disclosure",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/875249"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/xryj920/chrome_extensions/blob/main/extension.vn%202FA%20Authenticator%201.0.0.2%20exposes%20stored%20TOTP%20secrets%20through%20an%20unrestricted%20external%20message%20handler"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-31T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-08-31T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-08-31T07:08:09.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "extension.vn 2FA Authenticator Extension Background Service Worker chrome.runtime.onMessageExternal.addListener information disclosure",
      "x_generator": [
        "VulDB PVTS v202608"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-82810",
    "datePublished": "2026-08-31T16:45:09.367Z",
    "dateReserved": "2026-08-31T05:03:03.440Z",
    "dateUpdated": "2026-08-31T16:45:09.367Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-82810 (GCVE-0-2026-82810)

    Vulnerability from cvelistv5 – Published: 2026-08-31 16:45 – Updated: 2026-08-31 16:45
    VLAI
    Title
    extension.vn 2FA Authenticator Extension Background Service Worker chrome.runtime.onMessageExternal.addListener information disclosure
    Summary
    A weakness has been identified in extension.vn 2FA Authenticator Extension 1.0.0.2 on Chrome. The impacted element is the function chrome.runtime.onMessageExternal.addListener of the component Background Service Worker. Executing a manipulation of the argument sender.id can lead to information disclosure. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.
    Severity
    4.8 (Medium)
    CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
    3.3 (Low)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
    3.3 (Low)
    CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
    CWE
    Assigner
    References
    URL Tags
    https://vuldb.com/vuln/397229 vdb-entrytechnical-description
    https://vuldb.com/vuln/397229/cti signaturepermissions-required
    https://vuldb.com/cve/CVE-2026-82810 third-party-advisory
    https://vuldb.com/submit/875249 third-party-advisory
    https://github.com/xryj920/chrome_extensions/blob… exploit
    Impacted products
    Vendor Product Version
    extension.vn 2FA Authenticator Extension Affected: 1.0.0.2
        cpe:2.3:a:extension.vn:2fa_authenticator_extension:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    DRXYJ (VulDB User) VulDB CNA Team
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:extension.vn:2fa_authenticator_extension:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Background Service Worker"
          ],
          "product": "2FA Authenticator Extension",
          "vendor": "extension.vn",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0.2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "DRXYJ (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A weakness has been identified in extension.vn 2FA Authenticator Extension 1.0.0.2 on Chrome. The impacted element is the function chrome.runtime.onMessageExternal.addListener of the component Background Service Worker. Executing a manipulation of the argument sender.id can lead to information disclosure. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 1.7,
            "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "Information Disclosure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "Improper Access Controls",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T16:45:09.367Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-397229 | extension.vn 2FA Authenticator Extension Background Service Worker chrome.runtime.onMessageExternal.addListener information disclosure",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/397229"
        },
        {
          "name": "VDB-397229 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/397229/cti"
        },
        {
          "name": "CVE-2026-82810 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-82810"
        },
        {
          "name": "Submit #875249 | extension.vn 2FA Authenticator Chrome extension 1.0.0.2 Information Disclosure",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/875249"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/xryj920/chrome_extensions/blob/main/extension.vn%202FA%20Authenticator%201.0.0.2%20exposes%20stored%20TOTP%20secrets%20through%20an%20unrestricted%20external%20message%20handler"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-31T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-08-31T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-08-31T07:08:09.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "extension.vn 2FA Authenticator Extension Background Service Worker chrome.runtime.onMessageExternal.addListener information disclosure",
      "x_generator": [
        "VulDB PVTS v202608"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-82810",
    "datePublished": "2026-08-31T16:45:09.367Z",
    "dateReserved": "2026-08-31T05:03:03.440Z",
    "dateUpdated": "2026-08-31T16:45:09.367Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}