Vulnerability · Published Aug 31, 2026 · Assigned by VulDB

CVE-2026-82811Toggl OÜ Toggl Track Extension postMessage origin validation

Medium 5.4

In plain English

A medium-severity insufficient verification of data authenticity in Toggl Track Extension from Toggl OÜ. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 87.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in Toggl OÜ Toggl Track Extension 4.11.16. This affects an unknown function of the component postMessage Handler. The manipulation leads to origin validation error. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
Toggl OÜ	Toggl Track Extension	4.11.16

Weakness: CWE-346, CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R

References

VDB-397230 | Toggl OÜ Toggl Track Extension postMessage origin validation vdb-entry
VDB-397230 | CTI Indicators (IOB, IOC) signature, permissions-required
CVE-2026-82811 | CVE Analysis and Report third-party-advisory
Submit #875273 | Toggl OÜ Toggl Track 4.11.16 Origin Validation Error third-party-advisory
https://github.com/xryj920/chrome_extensions/blob/main/Toggl%20O%C3%9C%20Toggl%20Track%204.11.16%20accepts%20forged%20session-state%20messages%20through%20an%20unauthenticated%20postMessage%20handler exploit