Description

A security flaw has been discovered in vidIQ Vision for YouTube Extension 3.199.0 on Chrome. The affected element is the function window.addEventListener of the component postMessage Handler. Performing a manipulation of the argument vidiqEvent results in information disclosure. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor explains: "At this time, vidIQ does not accept security vulnerability submissions, and we do not have a bug bounty program in place."

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-31T17:17:47.150Z",
  "pubdate": "2026-08-31T17:17:47.150Z",
  "executiveSummary": "The vidIQ Vision for YouTube extension (version 3.199.0) contains an information disclosure vulnerability within its postMessage event handler. The flaw arises from an insecure implementation of the window.addEventListener function, specifically regarding the processing of the vidiqEvent argument.\nThis vulnerability allows a remote attacker to gain unauthorized access to sensitive information exposed through the extension's message communication channel. Because the postMessage API is often used for cross-context communication, improper validation of incoming messages or their arguments can lead to the unintended leakage of internal state or user data.\nThe vulnerability is remotely exploitable, requiring no prior authentication or elevated privileges from the attacker. Given that public exploit code exists, the risk to end-users is elevated. Current vendor policy states that they do not accept security submissions or maintain a bug bounty program, suggesting that timely remediation by the vendor may be delayed or unavailable.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper handling of messages within the postMessage event handler implemented in vidIQ Vision for YouTube 3.199.0. The extension utilizes window.addEventListener to listen for browser-level postMessage events. When an event is received, the application logic processes the payload provided in the vidiqEvent argument without sufficient origin verification or input sanitization.\nThe exploit flow begins with a malicious actor injecting a script into a context that can interact with the affected extension. By crafting a specifically formatted postMessage payload and sending it to the vulnerable listener, an attacker can trigger the extension to respond or perform actions that result in the disclosure of sensitive data. Because the extension listens globally on the window object, it fails to verify that the sender of the message is a trusted, same-origin domain, allowing any cross-origin script to communicate with the extension's internal messaging infrastructure.\nThe exploitation process follows these steps: first, the attacker identifies the message listener registered by the extension. Second, the attacker crafts a synthetic postMessage event containing a malformed or specifically manipulated vidiqEvent argument. Third, the attacker broadcasts this event to the browser window. Fourth, the vulnerable handler in the extension processes the message, incorrectly treating the untrusted input as a valid command or request. Finally, the extension, due to its privileged status within the browser, reflects sensitive information back to the attacker's script or executes logic that exposes internal variables to the attacker-controlled context.\nThis vulnerability is particularly severe because the postMessage interface is designed to facilitate communication between distinct browsing contexts. By failing to implement strict origin checking (e.g., verifying event.origin matches expected domains) and argument validation, the extension effectively turns its internal API into an open gateway for information leakage. The post-exploitation impact includes the potential exfiltration of sensitive configuration details, extension-specific tokens, or other localized data that the extension has been granted permission to access during its operation."
}