The rhwp browser extensions for Chrome and Firefox prior to version 0.2.4 and the rhwp application prior to 0.7.15 have a security flaw where service workers do not validate the origin of messages or URL schemes before performing privileged fetch operations. This allows an attacker controlling a webpage to make the extension fetch local or private network resources. If the fetched HWP or HWPX file contains an extractable preview image (PrvImage), the extension returns this preview as a data URI accessible to the page script, exposing potentially sensitive information. Additionally, the flaw allows internal resource existence and port scanning and fingerprinting of the extension's presence and version. The vulnerability requires a user to visit a malicious page with the vulnerable extension enabled. The issue is resolved in rhwp 0.7.15 and extension 0.2.4.

An attacker can leverage this vulnerability to access preview images embedded in local or private network HWP/HWPX files, potentially exposing sensitive information. The flaw also enables internal network reconnaissance such as resource existence and port probing, and fingerprinting of the extension's presence and version. However, exploitation requires user interaction and the disclosure is limited to extractable preview images only. There is no indication of code execution or broader system compromise.

This vulnerability is fixed in rhwp version 0.7.15 and rhwp Chrome and Firefox extensions version 0.2.4. Users and administrators should update to these versions or later to remediate the issue. No additional mitigation steps are required once updated.