Description

A weakness has been identified in extension.vn 2FA Authenticator Extension 1.0.0.2 on Chrome. The impacted element is the function chrome.runtime.onMessageExternal.addListener of the component Background Service Worker. Executing a manipulation of the argument sender.id can lead to information disclosure. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-08-31T17:17:47.313Z",
  "pubdate": "2026-08-31T17:17:47.313Z",
  "executiveSummary": "A vulnerability has been identified in the extension.vn 2FA Authenticator Extension version 1.0.0.2 for the Google Chrome browser. The security flaw stems from insufficient validation of external message origins within the background service worker.\nSpecifically, the component fails to properly verify the sender identity when utilizing the chrome.runtime.onMessageExternal.addListener function. This architectural weakness allows unauthorized entities to interact with the extension's message-passing interface.\nThe primary impact of this vulnerability is unauthorized information disclosure, potentially exposing sensitive authentication data managed by the extension. Exploitation requires local access to the target system, such as a malicious application or compromised browser environment capable of sending cross-extension messages.\nGiven that public exploit code is currently available, the risk to end-users is elevated. The vulnerability allows an attacker to bypass intended access controls by manipulating the sender.id parameter during the external communication process.\nThe vendor has been formally notified of these findings. Users should exercise caution and monitor for official updates or implement the recommended mitigations to prevent potential data exfiltration.",
  "technicalDetails": "The vulnerability resides within the background service worker of the extension.vn 2FA Authenticator Extension, specifically in how it handles inter-extension communication via the chrome.runtime.onMessageExternal API.\nThe root cause of this security defect is an insecure implementation of the event listener registered through the chrome.runtime.onMessageExternal.addListener function. In a secure extension architecture, this listener should strictly validate the 'sender.id' attribute against an allow-list of authorized extension IDs to ensure that only trusted applications can trigger internal functions or request sensitive data.\nIn the affected version 1.0.0.2, the extension fails to perform adequate verification of the sender.id parameter. An attacker can leverage this by crafting a malicious extension or script that interacts with the target's message listener. By providing a spoofed or intentionally manipulated sender.id, the attacker can force the extension to execute privileged functions or return data that should remain encapsulated within the extension's own execution context.\nThe attack flow proceeds as follows: First, the attacker ensures their malicious payload is running within the same browser environment as the target extension. Second, the attacker utilizes the chrome.runtime.sendMessage API, targeting the extension ID of the 2FA Authenticator. Third, because the listener lacks rigorous origin validation, the background service worker processes the incoming message as if it originated from a trusted source. Finally, the extension's internal logic processes the request and leaks information back to the attacker's malicious component.\nThis vulnerability is classified as an Information Disclosure issue. Post-exploitation, an attacker may be able to extract sensitive 2FA seeds, configuration details, or tokens stored within the extension's local state. Because the exploitation relies on the browser's internal messaging protocol, the attack is constrained to local access, meaning the attacker must be capable of executing code or deploying malicious extensions on the victim's workstation. The availability of public exploits significantly reduces the barrier to entry, as automated tools can be used to scan for and interact with the insecure listener, posing a direct threat to the confidentiality of the authentication secrets stored by the extension."
}