CVE-2026-19988
Received Received - Intake

Cross-Site Scripting in Alaev SEO Tools Extension

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulDB

Description
A vulnerability was detected in Alaev SEO Tools Extension up to 1.0.10 on Chrome. This impacts the function addDiv of the file src/popup.html of the component Popup UI. Performing a manipulation results in basic cross site scripting. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-19988
EUVD
EUVD-2026-60051

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
alaev seo_tools_extension to 1.0.10 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-80 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cross-site scripting (XSS) issue in the Alaev SEO Tools Extension up to version 1.0.10 for Chrome. It occurs in the addDiv function of the popup.html file. The extension collects untrusted SEO data like page titles and meta descriptions from webpages without sanitizing it. When this data is rendered in the extension's popup using innerHTML, attackers can inject malicious HTML markup. This allows them to manipulate the displayed content in the popup UI.

The attack requires user interaction, specifically opening the extension popup on a malicious webpage. The vendor was contacted but did not respond. The exploit is now public.

Detection Guidance

Check if the Alaev SEO Tools Extension version 1.0.10 or earlier is installed in your Chrome browser. Inspect the extension's popup UI for unexpected HTML rendering or injected content when visiting untrusted webpages. Review the extension's source code for use of innerHTML without input sanitization.

Impact Analysis

This vulnerability primarily affects the integrity of the extension's popup UI. Attackers could inject misleading SEO audit results, fake warnings, or deceptive links into the popup. This could trick users into believing false information about their website's SEO performance or security status.

The impact is limited to UI manipulation since no confirmed execution of extension-context JavaScript or access to private extension data has been demonstrated. Users may be misled but no direct data theft or system compromise is indicated.

Compliance Impact

This vulnerability primarily affects UI integrity by allowing HTML injection into the extension popup, which could mislead users with fake content or warnings. It does not directly expose sensitive data or enable code execution in the extension context, so its impact on compliance standards like GDPR or HIPAA is likely minimal unless misleading UI content leads to user actions that violate those standards.

Mitigation Strategies

Uninstall the Alaev SEO Tools Extension version 1.0.10 or earlier immediately. Avoid using the extension until a patched version is released. Monitor for any suspicious activity or misleading content in browser extensions. Report the issue to the vendor if not already addressed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19988. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart