CVE-2026-82809CWE-200CWE-284broken-access-controlinformation-disclosure

CVE-2026-82809

Medium · published August 31, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
37.7
In the wild
Unconfirmed
What it is

A security flaw has been discovered in vidIQ Vision for YouTube Extension 3.199.0 on Chrome. The affected element is the function window.addEventListener of the component postMessage Handler. Performing a manipulation of the argument vidiqEvent results in information disclosure. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor explains: "At this time, vidIQ does not accept security vulnerability submissions, and we do not have a bug bounty program in place."

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00445 · 37.7th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-284 · Improper Access Control
Published
2026-08-31T21:17Z
References (5)
https://github.com/xryj920/chrome_extensions/blob/main/vidIQ%20Inc.%20vidIQ%20Vision%20for%20YouTube%203.199.0%20exposes%20YouTube%20video%20frame%20captures%20through%20an%20unauthenticated%20postMessage%20handler · [email protected]https://vuldb.com/cve/CVE-2026-82809 · [email protected]https://vuldb.com/submit/875245 · [email protected]https://vuldb.com/vuln/397228 · [email protected]https://vuldb.com/vuln/397228/cti · [email protected]
EPSS history
Timeline
  • 02 SEP 03:40Z
    EPSS moved — → 0%
    epss
  • 31 AUG 16:30Z
    vidIQ Vision for YouTube Extension postMessage window.addEventListener information disclosure
    cvelistv5