Vulnerability · Published Aug 31, 2026 · Assigned by VulDB
CVE-2026-82809vidIQ Vision for YouTube Extension postMessage window.addEventListener information disclosure
Medium 4.3
In plain English
A medium-severity information exposure in Vision for YouTube Extension from vidIQ. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Official description
A security flaw has been discovered in vidIQ Vision for YouTube Extension 3.199.0 on Chrome. The affected element is the function window.addEventListener of the component postMessage Handler. Performing a manipulation of the argument vidiqEvent results in information disclosure. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor explains: "At this time, vidIQ does not accept security vulnerability submissions, and we do not have a bug bounty program in place."
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| vidIQ | Vision for YouTube Extension | 3.199.0 |
Weakness: CWE-200, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
References
- VDB-397228 | vidIQ Vision for YouTube Extension postMessage window.addEventListener information disclosure vdb-entry, technical-description
- VDB-397228 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-82809 | CVE Analysis and Report third-party-advisory
- Submit #875245 | vidIQ Inc. vidIQ Vision for YouTube 3.199.0 Information Disclosure third-party-advisory
- https://github.com/xryj920/chrome_extensions/blob/main/vidIQ%20Inc.%20vidIQ%20Vision%20for%20YouTube%203.199.0%20exposes%20YouTube%20video%20frame%20captures%20through%20an%20unauthenticated%20postMessage%20handler exploit, media-coverage