CVE-2026-82810: Information Disclosure in extension.vn 2FA Authenticator Extension

The vulnerability CVE-2026-82810 affects extension.vn 2FA Authenticator Extension version 1.0.0.2 on Chrome. It involves improper handling of the sender.id argument in the chrome.runtime.onMessageExternal.addListener function within the Background Service Worker component. This weakness can be exploited by an attacker with local access to cause information disclosure. The exploit has been publicly released. The vendor was notified early, but no remediation level or patch information is currently available.

Successful exploitation of this vulnerability can lead to disclosure of sensitive information from the extension due to manipulation of the sender.id parameter. The attack requires local access, limiting remote exploitation. The medium CVSS score (4.8) reflects the moderate risk posed by this flaw. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround has been published, users should exercise caution and limit local access to trusted parties until a patch is available.