CVE-2026-19992 - Vulnerability Details

- Orange View Limited DualSafe Password Manager & Digital Vault Extension postMessage-based Bridge information disclosure

Description

A flaw has been found in Orange View Limited DualSafe Password Manager & Digital Vault Extension up to 1.4.35 on Chrome. Affected is an unknown function of the component postMessage-based Bridge. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

Published: 2026-08-17

Score: 2.3 Low

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Orange View Limited

DualSafe Password Manager & Digital Vault Extension

affected

Version	Status	Constraints
`1.4.0`	affected	—
`1.4.1`	affected	—
`1.4.2`	affected	—
`1.4.3`	affected	—
`1.4.4`	affected	—
`1.4.5`	affected	—
`1.4.6`	affected	—
`1.4.7`	affected	—
`1.4.8`	affected	—
`1.4.9`	affected	—
`1.4.10`	affected	—
`1.4.11`	affected	—
`1.4.12`	affected	—
`1.4.13`	affected	—
`1.4.14`	affected	—
`1.4.15`	affected	—
`1.4.16`	affected	—
`1.4.17`	affected	—
`1.4.18`	affected	—
`1.4.19`	affected	—
`1.4.20`	affected	—
`1.4.21`	affected	—
`1.4.22`	affected	—
`1.4.23`	affected	—
`1.4.24`	affected	—
`1.4.25`	affected	—
`1.4.26`	affected	—
`1.4.27`	affected	—
`1.4.28`	affected	—
`1.4.29`	affected	—
`1.4.30`	affected	—
`1.4.31`	affected	—
`1.4.32`	affected	—
`1.4.33`	affected	—
`1.4.34`	affected	—
`1.4.35`	affected	—

No data.

Vendor Product Confidence Versions

Orange View Limited

Dualsafe Password Manager Digital Vault Extension

94%

Version	Status	Scheme	Platform
`1.4.0`	affected	semver	—
`1.4.1`	affected	semver	—
`1.4.2`	affected	semver	—
`1.4.3`	affected	semver	—
`1.4.4`	affected	semver	—
`1.4.5`	affected	semver	—
`1.4.6`	affected	semver	—
`1.4.7`	affected	semver	—
`1.4.8`	affected	semver	—
`1.4.9`	affected	semver	—
`1.4.10`	affected	semver	—
`1.4.11`	affected	semver	—
`1.4.12`	affected	semver	—
`1.4.13`	affected	semver	—
`1.4.14`	affected	semver	—
`1.4.15`	affected	semver	—
`1.4.16`	affected	semver	—
`1.4.17`	affected	semver	—
`1.4.18`	affected	semver	—
`1.4.19`	affected	semver	—
`1.4.20`	affected	semver	—
`1.4.21`	affected	semver	—
`1.4.22`	affected	semver	—
`1.4.23`	affected	semver	—
`1.4.24`	affected	semver	—
`1.4.25`	affected	semver	—
`1.4.26`	affected	semver	—
`1.4.27`	affected	semver	—
`1.4.28`	affected	semver	—
`1.4.29`	affected	semver	—
`1.4.30`	affected	semver	—
`1.4.31`	affected	semver	—
`1.4.32`	affected	semver	—
`1.4.33`	affected	semver	—
`1.4.34`	affected	semver	—
`1.4.35`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction Required

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity High

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00305.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/xryj920/chrome_extensions/blob/main/Orange%20View%20Limited%20DualSafe%20Password%20Manager%20%26%20Digital%20Vault%201.4.35%20exposes%20stored%20credentials%20and%20TOTP%20codes%20through%20an%20unauthenticated%20postMessage%20bridge
https://vuldb.com/cve/CVE-2026-19992
https://vuldb.com/submit/873941
https://vuldb.com/vuln/391193
https://vuldb.com/vuln/391193/cti

History

Mon, 17 Aug 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		A flaw has been found in Orange View Limited DualSafe Password Manager & Digital Vault Extension up to 1.4.35 on Chrome. Affected is an unknown function of the component postMessage-based Bridge. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
Title		Orange View Limited DualSafe Password Manager & Digital Vault Extension postMessage-based Bridge information disclosure
First Time appeared		Orange View Limited Orange View Limited dualsafe Password Manager Digital Vault Extension
Weaknesses		CWE-200 CWE-284
CPEs		cpe:2.3:a:orange_view_limited:dualsafe_password_manager_digital_vault_extension::::::::
Vendors & Products		Orange View Limited Orange View Limited dualsafe Password Manager Digital Vault Extension
References		https://github.com/xryj920/chrome_extensions/blob/main/Orange%20View%20Limited%20DualSafe%20Password%20Manager%20%26%20Digital%20Vault%201.4.35%20exposes%20stored%20credentials%20and%20TOTP%20codes%20through%20an%20unauthenticated%20postMessage%20bridge https://vuldb.com/cve/CVE-2026-19992 https://vuldb.com/submit/873941 https://vuldb.com/vuln/391193 https://vuldb.com/vuln/391193/cti
Metrics		cvssV2_0 `{'score': 2.6, 'vector': 'AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 3.1, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Orange View Limited Dualsafe Password Manager Digital Vault Extension

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-08-17T05:45:08.900Z

Updated: 2026-08-17T15:29:52.953Z

Reserved: 2026-08-16T17:47:37.166Z

Link: CVE-2026-19992

Vulnrichment

Updated: 2026-08-17T15:29:48.940Z

NVD

Status : Received

Published: 2026-08-17T06:17:39.770

Modified: 2026-08-17T16:16:55.473

Link: CVE-2026-19992

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-17T10:15:04Z

Weaknesses

CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CWE-284
Improper Access Control

Tracking

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction Required

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity High

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object