Vision For Youtube Extension
Monthly
Information disclosure in vidIQ Vision for YouTube Extension 3.199.0 on Chrome exposes YouTube video frame captures to any web page able to send crafted postMessage events. The extension's window.addEventListener handler processes incoming messages without validating the sender origin, allowing a remotely-hosted malicious page to exfiltrate frame capture data by manipulating the vidiqEvent argument. No patch is available - the vendor has explicitly stated they do not accept vulnerability submissions and operate no bug bounty program - and a public proof-of-concept exploit is available on GitHub.
Information disclosure in vidIQ Vision for YouTube Extension 3.199.0 on Chrome exposes YouTube video frame captures to any web page able to send crafted postMessage events. The extension's window.addEventListener handler processes incoming messages without validating the sender origin, allowing a remotely-hosted malicious page to exfiltrate frame capture data by manipulating the vidiqEvent argument. No patch is available - the vendor has explicitly stated they do not accept vulnerability submissions and operate no bug bounty program - and a public proof-of-concept exploit is available on GitHub.