CVE-2026-19992CWE-200CWE-284broken-access-controlinformation-disclosure

CVE-2026-19992

Low · published August 17, 2026

CVSS v3.1
3.1
EPSS
0%
Percentile
31.6
In the wild
Unconfirmed
What it is

A flaw has been found in Orange View Limited DualSafe Password Manager & Digital Vault Extension up to 1.4.35 on Chrome. Affected is an unknown function of the component postMessage-based Bridge. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
2.3 · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00387 · 31.6th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-284 · Improper Access Control
Published
2026-08-17T10:17Z
References (5)
https://github.com/xryj920/chrome_extensions/blob/main/Orange%20View%20Limited%20DualSafe%20Password%20Manager%20%26%20Digital%20Vault%201.4.35%20exposes%20stored%20credentials%20and%20TOTP%20codes%20through%20an%20unauthenticated%20postMessage%20bridge · [email protected]https://vuldb.com/cve/CVE-2026-19992 · [email protected]https://vuldb.com/submit/873941 · [email protected]https://vuldb.com/vuln/391193 · [email protected]https://vuldb.com/vuln/391193/cti · [email protected]
EPSS history
Timeline
  • 17 AUG 05:45Z
    Orange View Limited DualSafe Password Manager & Digital Vault Extension postMessage-based Bridge information disclosure
    cvelistv5