This vulnerability affects the DualSafe Password Manager & Digital Vault Extension up to version 1.4.35 on Chrome. It involves an unknown function within the postMessage-based Bridge component that can be manipulated remotely to cause information disclosure. The attack requires high complexity and no privileges or user interaction are required, but the impact is limited to low confidentiality impact. The vendor was contacted early, but no remediation level or patch information is available. The CVSS 4.0 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, low confidentiality impact, and no impact on integrity or availability.

The vulnerability allows remote attackers to disclose information through manipulation of the postMessage-based Bridge component. The impact is limited to information disclosure with low confidentiality impact. There is no impact on integrity or availability. Exploitation is difficult due to high attack complexity and requires user interaction. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, consider limiting use of the affected extension versions or applying organizational controls to reduce exposure.