CVE-2026-82809
Received Received - Intake

Information Disclosure in vidIQ Vision for YouTube Extension

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulDB

Description
A security flaw has been discovered in vidIQ Vision for YouTube Extension 3.199.0 on Chrome. The affected element is the function window.addEventListener of the component postMessage Handler. Performing a manipulation of the argument vidiqEvent results in information disclosure. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor explains: "At this time, vidIQ does not accept security vulnerability submissions, and we do not have a bug bounty program in place."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82809
EUVD
EUVD-2026-68656

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vidiq vision_for_youtube_extension 3.199.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the vidIQ Vision for YouTube Chrome extension version 3.199.0. It involves an unauthenticated postMessage handler that exposes YouTube video frame captures. The extension's message listener responds to messages with vidiqEvent: getVideoStill without validating the sender's origin, allowing unauthorized scripts to request and receive still images of the currently playing video.

Detection Guidance

Check for the presence of the vidIQ Vision for YouTube extension version 3.199.0 in your Chrome browser. Inspect network traffic for unauthenticated postMessage handlers sending video frame data. Look for suspicious base64-encoded image data in responses.

Impact Analysis

An attacker could exploit this to capture frames from private, unlisted, or sensitive YouTube videos you are viewing. This could lead to unauthorized access to confidential or personal content displayed in those frames.

Mitigation Strategies

Remove or disable the vidIQ Vision for YouTube extension version 3.199.0 immediately. Avoid using the extension until a patched version is released. Monitor for unauthorized video frame captures or data exfiltration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82809. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart