CVE-2026-19992 (GCVE-0-2026-19992)
Vulnerability from cvelistv5
Published
2026-08-17 05:45
Modified
2026-08-17 15:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A flaw has been found in Orange View Limited DualSafe Password Manager & Digital Vault Extension up to 1.4.35 on Chrome. Affected is an unknown function of the component postMessage-based Bridge. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Orange View Limited | DualSafe Password Manager & Digital Vault Extension |
Version: 1.4.0 Version: 1.4.1 Version: 1.4.2 Version: 1.4.3 Version: 1.4.4 Version: 1.4.5 Version: 1.4.6 Version: 1.4.7 Version: 1.4.8 Version: 1.4.9 Version: 1.4.10 Version: 1.4.11 Version: 1.4.12 Version: 1.4.13 Version: 1.4.14 Version: 1.4.15 Version: 1.4.16 Version: 1.4.17 Version: 1.4.18 Version: 1.4.19 Version: 1.4.20 Version: 1.4.21 Version: 1.4.22 Version: 1.4.23 Version: 1.4.24 Version: 1.4.25 Version: 1.4.26 Version: 1.4.27 Version: 1.4.28 Version: 1.4.29 Version: 1.4.30 Version: 1.4.31 Version: 1.4.32 Version: 1.4.33 Version: 1.4.34 Version: 1.4.35 cpe:2.3:a:orange_view_limited:dualsafe_password_manager_digital_vault_extension:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19992",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T15:29:41.127568Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:29:52.953Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:orange_view_limited:dualsafe_password_manager_digital_vault_extension:*:*:*:*:*:*:*:*"
],
"modules": [
"postMessage-based Bridge"
],
"product": "DualSafe Password Manager \u0026 Digital Vault Extension",
"vendor": "Orange View Limited",
"versions": [
{
"status": "affected",
"version": "1.4.0"
},
{
"status": "affected",
"version": "1.4.1"
},
{
"status": "affected",
"version": "1.4.2"
},
{
"status": "affected",
"version": "1.4.3"
},
{
"status": "affected",
"version": "1.4.4"
},
{
"status": "affected",
"version": "1.4.5"
},
{
"status": "affected",
"version": "1.4.6"
},
{
"status": "affected",
"version": "1.4.7"
},
{
"status": "affected",
"version": "1.4.8"
},
{
"status": "affected",
"version": "1.4.9"
},
{
"status": "affected",
"version": "1.4.10"
},
{
"status": "affected",
"version": "1.4.11"
},
{
"status": "affected",
"version": "1.4.12"
},
{
"status": "affected",
"version": "1.4.13"
},
{
"status": "affected",
"version": "1.4.14"
},
{
"status": "affected",
"version": "1.4.15"
},
{
"status": "affected",
"version": "1.4.16"
},
{
"status": "affected",
"version": "1.4.17"
},
{
"status": "affected",
"version": "1.4.18"
},
{
"status": "affected",
"version": "1.4.19"
},
{
"status": "affected",
"version": "1.4.20"
},
{
"status": "affected",
"version": "1.4.21"
},
{
"status": "affected",
"version": "1.4.22"
},
{
"status": "affected",
"version": "1.4.23"
},
{
"status": "affected",
"version": "1.4.24"
},
{
"status": "affected",
"version": "1.4.25"
},
{
"status": "affected",
"version": "1.4.26"
},
{
"status": "affected",
"version": "1.4.27"
},
{
"status": "affected",
"version": "1.4.28"
},
{
"status": "affected",
"version": "1.4.29"
},
{
"status": "affected",
"version": "1.4.30"
},
{
"status": "affected",
"version": "1.4.31"
},
{
"status": "affected",
"version": "1.4.32"
},
{
"status": "affected",
"version": "1.4.33"
},
{
"status": "affected",
"version": "1.4.34"
},
{
"status": "affected",
"version": "1.4.35"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "DRXYJ (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Orange View Limited DualSafe Password Manager \u0026 Digital Vault Extension up to 1.4.35 on Chrome. Affected is an unknown function of the component postMessage-based Bridge. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Information Disclosure",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:45:08.900Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-391193 | Orange View Limited DualSafe Password Manager \u0026 Digital Vault Extension postMessage-based Bridge information disclosure",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/391193"
},
{
"name": "VDB-391193 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/391193/cti"
},
{
"name": "CVE-2026-19992 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19992"
},
{
"name": "Submit #873941 | Orange View Limited DualSafe Password Manager \u0026 Digital Vault 1.4.35 Information Disclosure",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/873941"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/xryj920/chrome_extensions/blob/main/Orange%20View%20Limited%20DualSafe%20Password%20Manager%20%26%20Digital%20Vault%201.4.35%20exposes%20stored%20credentials%20and%20TOTP%20codes%20through%20an%20unauthenticated%20postMessage%20bridge"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-16T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-16T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-16T19:52:43.000Z",
"value": "VulDB entry last update"
}
],
"title": "Orange View Limited DualSafe Password Manager \u0026 Digital Vault Extension postMessage-based Bridge information disclosure",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19992",
"datePublished": "2026-08-17T05:45:08.900Z",
"dateReserved": "2026-08-16T17:47:37.166Z",
"dateUpdated": "2026-08-17T15:29:52.953Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"shortName\": \"VulDB\", \"dateUpdated\": \"2026-08-17T05:45:08.900Z\"}, \"title\": \"Orange View Limited DualSafe Password Manager \u0026 Digital Vault Extension postMessage-based Bridge information disclosure\", \"problemTypes\": [{\"descriptions\": [{\"type\": \"CWE\", \"cweId\": \"CWE-200\", \"lang\": \"en\", \"description\": \"Information Disclosure\"}]}, {\"descriptions\": [{\"type\": \"CWE\", \"cweId\": \"CWE-284\", \"lang\": \"en\", \"description\": \"Improper Access Controls\"}]}], \"affected\": [{\"vendor\": \"Orange View Limited\", \"product\": \"DualSafe Password Manager \u0026 Digital Vault Extension\", \"versions\": [{\"version\": \"1.4.0\", \"status\": \"affected\"}, {\"version\": \"1.4.1\", \"status\": \"affected\"}, {\"version\": \"1.4.2\", \"status\": \"affected\"}, {\"version\": \"1.4.3\", \"status\": \"affected\"}, {\"version\": \"1.4.4\", \"status\": \"affected\"}, {\"version\": \"1.4.5\", \"status\": \"affected\"}, {\"version\": \"1.4.6\", \"status\": \"affected\"}, {\"version\": \"1.4.7\", \"status\": \"affected\"}, {\"version\": \"1.4.8\", \"status\": \"affected\"}, {\"version\": \"1.4.9\", \"status\": \"affected\"}, {\"version\": \"1.4.10\", \"status\": \"affected\"}, {\"version\": \"1.4.11\", \"status\": \"affected\"}, {\"version\": \"1.4.12\", \"status\": \"affected\"}, {\"version\": \"1.4.13\", \"status\": \"affected\"}, {\"version\": \"1.4.14\", \"status\": \"affected\"}, {\"version\": \"1.4.15\", \"status\": \"affected\"}, {\"version\": \"1.4.16\", \"status\": \"affected\"}, {\"version\": \"1.4.17\", \"status\": \"affected\"}, {\"version\": \"1.4.18\", \"status\": \"affected\"}, {\"version\": \"1.4.19\", \"status\": \"affected\"}, {\"version\": \"1.4.20\", \"status\": \"affected\"}, {\"version\": \"1.4.21\", \"status\": \"affected\"}, {\"version\": \"1.4.22\", \"status\": \"affected\"}, {\"version\": \"1.4.23\", \"status\": \"affected\"}, {\"version\": \"1.4.24\", \"status\": \"affected\"}, {\"version\": \"1.4.25\", \"status\": \"affected\"}, {\"version\": \"1.4.26\", \"status\": \"affected\"}, {\"version\": \"1.4.27\", \"status\": \"affected\"}, {\"version\": \"1.4.28\", \"status\": \"affected\"}, {\"version\": \"1.4.29\", \"status\": \"affected\"}, {\"version\": \"1.4.30\", \"status\": \"affected\"}, {\"version\": \"1.4.31\", \"status\": \"affected\"}, {\"version\": \"1.4.32\", \"status\": \"affected\"}, {\"version\": \"1.4.33\", \"status\": \"affected\"}, {\"version\": \"1.4.34\", \"status\": \"affected\"}, {\"version\": \"1.4.35\", \"status\": \"affected\"}], \"cpes\": [\"cpe:2.3:a:orange_view_limited:dualsafe_password_manager_digital_vault_extension:*:*:*:*:*:*:*:*\"], \"modules\": [\"postMessage-based Bridge\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw has been found in Orange View Limited DualSafe Password Manager \u0026 Digital Vault Extension up to 1.4.35 on Chrome. Affected is an unknown function of the component postMessage-based Bridge. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure.\"}], \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 2.3, \"vectorString\": \"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P\", \"baseSeverity\": \"LOW\"}}, {\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 3.1, \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R\", \"baseSeverity\": \"LOW\"}}, {\"cvssV3_0\": {\"version\": \"3.0\", \"baseScore\": 3.1, \"vectorString\": \"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R\", \"baseSeverity\": \"LOW\"}}, {\"cvssV2_0\": {\"version\": \"2.0\", \"baseScore\": 2.6, \"vectorString\": \"AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR\"}}], \"timeline\": [{\"time\": \"2026-08-16T00:00:00.000Z\", \"lang\": \"en\", \"value\": \"Advisory disclosed\"}, {\"time\": \"2026-08-16T02:00:00.000Z\", \"lang\": \"en\", \"value\": \"VulDB entry created\"}, {\"time\": \"2026-08-16T19:52:43.000Z\", \"lang\": \"en\", \"value\": \"VulDB entry last update\"}], \"credits\": [{\"lang\": \"en\", \"value\": \"DRXYJ (VulDB User)\", \"type\": \"reporter\"}, {\"lang\": \"en\", \"value\": \"VulDB CNA Team\", \"type\": \"coordinator\"}], \"references\": [{\"url\": \"https://vuldb.com/vuln/391193\", \"name\": \"VDB-391193 | Orange View Limited DualSafe Password Manager \u0026 Digital Vault Extension postMessage-based Bridge information disclosure\", \"tags\": [\"vdb-entry\"]}, {\"url\": \"https://vuldb.com/vuln/391193/cti\", \"name\": \"VDB-391193 | CTI Indicators (IOB, IOC, TTP)\", \"tags\": [\"signature\", \"permissions-required\"]}, {\"url\": \"https://vuldb.com/cve/CVE-2026-19992\", \"name\": \"CVE-2026-19992 | CVE Analysis and Report\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://vuldb.com/submit/873941\", \"name\": \"Submit #873941 | Orange View Limited DualSafe Password Manager \u0026 Digital Vault 1.4.35 Information Disclosure\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://github.com/xryj920/chrome_extensions/blob/main/Orange%20View%20Limited%20DualSafe%20Password%20Manager%20%26%20Digital%20Vault%201.4.35%20exposes%20stored%20credentials%20and%20TOTP%20codes%20through%20an%20unauthenticated%20postMessage%20bridge\", \"tags\": [\"exploit\"]}], \"x_generator\": [\"VulDB PVTS v202608\"]}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-19992\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-17T15:29:41.127568Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-17T15:29:48.940Z\"}}]}",
"cveMetadata": "{\"cveId\": \"CVE-2026-19992\", \"assignerOrgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"VulDB\", \"dateReserved\": \"2026-08-16T17:47:37.166Z\", \"datePublished\": \"2026-08-17T05:45:08.900Z\", \"dateUpdated\": \"2026-08-17T15:29:52.953Z\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…