CVE-2026-35467CWE-522

Private Key stored as extractable in browser IndexeDB

High · published April 2, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
18.0
In the wild
Unconfirmed
What it is

The stored API keys in temporary browser client is not marked as protected allowing for JavScript console or other errors to allow for extraction of the encryption credentials.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00268 · 18.0th percentile
Weakness
CWE-522 · Insufficiently Protected Credentials
Published
2026-04-02T20:27Z
EPSS history
Timeline
  • 02 APR 20:27Z
    Private Key stored as extractable in browser IndexeDB
    cvelistv5