EUVD-2026-60054
GHSA-9cmp-j799-r3pj
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered via malicious page with required user interaction; full credential and TOTP exfiltration justifies C:H and scope change, not VC:L as officially scored.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in Orange View Limited DualSafe Password Manager & Digital Vault Extension up to 1.4.35 on Chrome. Affected is an unknown function of the component postMessage-based Bridge. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
AnalysisAI
DualSafe Password Manager & Digital Vault Extension (versions up to and including 1.4.35 for Chrome) exposes stored credentials and TOTP codes through an unauthenticated postMessage-based bridge, enabling cross-origin secret exfiltration by any webpage the victim visits. The extension's bridge component processes incoming postMessage calls without validating the sender's origin, meaning an attacker-controlled page can query the vault directly without any extension-level authentication. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: the target user must have DualSafe Password Manager & Digital Vault Extension version 1.4.35 or earlier installed in Chrome, the vault must be in an unlocked state at the time of the attack, and the user must navigate to a webpage under attacker control (including any site where an attacker can inject JavaScript via XSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 4.0 base score of 2.3 (VC:L) materially understates the real-world impact: the publicly available proof-of-concept explicitly demonstrates exfiltration of stored passwords and TOTP codes - the complete credential corpus a user has entrusted to the vault - which represents a High confidentiality impact at the individual level rather than Low. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at the time of analysis; the vendor was reportedly contacted prior to public disclosure but no fixed version number appears in any available reference. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today