CVE-2026-82810
Received Received - Intake

Information Disclosure in 2FA Authenticator Extension

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulDB

Description
A weakness has been identified in extension.vn 2FA Authenticator Extension 1.0.0.2 on Chrome. The impacted element is the function chrome.runtime.onMessageExternal.addListener of the component Background Service Worker. Executing a manipulation of the argument sender.id can lead to information disclosure. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82810
EUVD
EUVD-2026-68657

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
extension.vn 2fa_authenticator_extension 1.0.0.2
extension.vn 2fa_authenticator 1.0.0.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-82810 is a vulnerability in the extension.vn 2FA Authenticator Chrome extension version 1.0.0.2. It involves an unrestricted external message handler in the background service worker that exposes stored TOTP secrets. The function chrome.runtime.onMessageExternal.addListener lacks sender validation, allowing malicious co-installed extensions to request and retrieve stored TOTP secrets, including issuer, account, and secret key data.

Detection Guidance

Check if the extension.vn 2FA Authenticator Extension 1.0.0.2 is installed in Chrome. Inspect Chrome extensions for the presence of chrome.runtime.onMessageExternal.addListener in the background service worker. Look for unauthorized external message handlers or suspicious requests to retrieve stored TOTP secrets.

Impact Analysis

This vulnerability allows attackers with local access to retrieve stored TOTP secrets. With these secrets, attackers can generate valid two-factor authentication codes independently, potentially bypassing 2FA even if they only have the account password. This could lead to unauthorized access to accounts protected by this extension.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating confidentiality requirements under GDPR and HIPAA. Exposure of TOTP secrets may result in non-compliance with data protection regulations, as it undermines the integrity of authentication mechanisms designed to protect personal or health information.

Mitigation Strategies

Uninstall the vulnerable extension.vn 2FA Authenticator Extension 1.0.0.2 immediately. Update to the latest version if available. Ensure no other extensions are installed that could exploit this vulnerability. Monitor for unauthorized access or TOTP code generation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82810. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart