Rhwp
Monthly
The rhwp Chrome and Firefox extensions prior to 0.2.4 (with the rhwp core library prior to 0.7.15) ship a service-worker message path that never validates the message sender, the URL scheme, or the destination address, so any untrusted web page the victim visits can coerce the extension's fetch-file and extract-thumbnail handlers into requesting localhost, loopback, link-local, private-IP, or internal-hostname resources. This gives an attacker internal-resource existence and port probing plus extension presence/version fingerprinting, and when the targeted HWP/HWPX document contains an extractable PrvImage the preview is returned as a data URI that page script can read directly from the DOM. Exploitation requires the extension to be installed and enabled and the user to visit an attacker-controlled page; there is no confirmed active exploitation (no CISA KEV entry) and no public exploit code identified at time of analysis, with impact limited to low-value confidentiality loss. Vendor-released fixes are available in rhwp 0.7.15 and extension 0.2.4.
The rhwp Chrome and Firefox extensions prior to 0.2.4 (with the rhwp core library prior to 0.7.15) ship a service-worker message path that never validates the message sender, the URL scheme, or the destination address, so any untrusted web page the victim visits can coerce the extension's fetch-file and extract-thumbnail handlers into requesting localhost, loopback, link-local, private-IP, or internal-hostname resources. This gives an attacker internal-resource existence and port probing plus extension presence/version fingerprinting, and when the targeted HWP/HWPX document contains an extractable PrvImage the preview is returned as a data URI that page script can read directly from the DOM. Exploitation requires the extension to be installed and enabled and the user to visit an attacker-controlled page; there is no confirmed active exploitation (no CISA KEV entry) and no public exploit code identified at time of analysis, with impact limited to low-value confidentiality loss. Vendor-released fixes are available in rhwp 0.7.15 and extension 0.2.4.