EUVD-2026-82426Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Attacker-controlled web page reaches the victim's extension over the network with no auth (AV:N/PR:N) but needs the victim to visit it (UI:R); extension pivots into private network so S:C; only limited preview/probe leakage gives C:L, I:N, A:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions use an all-URLs host permission to detect HWP and HWPX links on visited pages, but the service workers do not validate message senders, URL schemes, or destination addresses before privileged fetches. The affected paths are rhwp-chrome/manifest.json, rhwp-chrome/content-script.js, rhwp-chrome/sw/message-router.js, rhwp-chrome/sw/thumbnail-extractor.js, rhwp-firefox/manifest.json, rhwp-firefox/content-script.js, rhwp-firefox/sw/message-router.js, and rhwp-firefox/sw/thumbnail-extractor.js. An untrusted page can make the fetch-file and extract-thumbnail handlers request localhost or private-network resources. When a target HWP or HWPX file contains an extractable PrvImage, the extension returns the preview as a data URI in page-readable DOM, allowing page script to read it. The flaw also permits internal-resource existence and port probing and extension presence or version fingerprinting. Exploitation requires a user to visit an untrusted page while the extension is enabled, and preview disclosure is limited to an extractable PrvImage. This issue is fixed in rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4.
AnalysisAI
The rhwp Chrome and Firefox extensions prior to 0.2.4 (with the rhwp core library prior to 0.7.15) ship a service-worker message path that never validates the message sender, the URL scheme, or the destination address, so any untrusted web page the victim visits can coerce the extension's fetch-file and extract-thumbnail handlers into requesting localhost, loopback, link-local, private-IP, or internal-hostname resources. This gives an attacker internal-resource existence and port probing plus extension presence/version fingerprinting, and when the targeted HWP/HWPX document contains an extractable PrvImage the preview is returned as a data URI that page script can read directly from the DOM. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the victim to have the rhwp Chrome or Firefox extension (version < 0.2.4, using the all-URLs host permission) installed and enabled, and to visit an attacker-controlled web page (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely medium-severity information-disclosure issue, not an inflated high. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade rhwp to 0.7.15 (release tag v0.7.15) and update both the rhwp Chrome extension and rhwp Firefox extension to 0.2.4 or later; the fixing change is commit e07b76ba79f42078c6cdf1045b58f894ec55bdf9, documented in advisory GHSA-j972-m9fh-g22m. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today