EUVD-2026-68657
GHSA-7rrg-c5fp-7863
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access required (AV:L) with low-privilege attacker able to install extensions (PR:L); only limited confidentiality impact via TOTP secret leakage, no integrity or availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A weakness has been identified in extension.vn 2FA Authenticator Extension 1.0.0.2 on Chrome. The impacted element is the function chrome.runtime.onMessageExternal.addListener of the component Background Service Worker. Executing a manipulation of the argument sender.id can lead to information disclosure. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.
AnalysisAI
Information disclosure in extension.vn 2FA Authenticator Extension 1.0.0.2 for Chrome exposes stored TOTP secrets via an unvalidated external message listener. The Background Service Worker's chrome.runtime.onMessageExternal.addListener handler fails to verify the sender.id field, meaning any other locally-installed Chrome extension can send a crafted message and receive TOTP seeds in response. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concurrent conditions: (1) the victim must have extension.vn 2FA Authenticator Extension 1.0.0.2 installed and its Background Service Worker active in Chrome, and (2) the attacker must be able to install a second malicious Chrome extension on the same browser profile, requiring local access (PR:L per CVSS 4.0). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 1.9 accurately reflects the constrained attack vector (AV:L, PR:L), yet the functional impact - leakage of raw TOTP secrets - is disproportionately severe relative to that score: possession of a TOTP seed enables indefinite generation of valid one-time passwords, fully defeating the second factor. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today