CVE-2026-82809
vidIQ Vision for YouTube Extension postMessage window.addEventListener information disclosure
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
A security flaw has been discovered in vidIQ Vision for YouTube Extension 3.199.0 on Chrome. The affected element is the function window.addEventListener of the component postMessage Handler. Performing a manipulation of the argument vidiqEvent results in information disclosure. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor explains: "At this time, vidIQ does not accept security vulnerability submissions, and we do not have a bug bounty program in place."
| CWE | CWE-200 CWE-284 |
| Vendor | vidiq |
| Product | vision for youtube extension |
| Published | Aug 31, 2026 |
| Last Updated | Aug 31, 2026 |
Stay Ahead of the Next One
Get instant alerts for vidiq vision for youtube extension
Be the first to know when new medium vulnerabilities affecting vidiq vision for youtube extension are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
vidIQ / Vision for YouTube Extension
3.199.0
References
vuldb.com: https://vuldb.com/vuln/397228 vuldb.com: https://vuldb.com/vuln/397228/cti vuldb.com: https://vuldb.com/cve/CVE-2026-82809 vuldb.com: https://vuldb.com/submit/875245 github.com: https://github.com/xryj920/chrome_extensions/blob/main/vidIQ%20Inc.%20vidIQ%20Vision%20for%20YouTube%203.199.0%20exposes%20YouTube%20video%20frame%20captures%20through%20an%20unauthenticated%20postMessage%20handler
Credits
🔍 DRXYJ (VulDB User) VulDB CNA Team