CVE-2026-82810: 2FA Authenticator Extension Data Leak

CVE-2026-82810 Overview

CVE-2026-82810 is an information disclosure vulnerability in the extension.vn 2FA Authenticator Extension version 1.0.0.2 for Google Chrome. The flaw resides in the chrome.runtime.onMessageExternal.addListener function within the extension's Background Service Worker. An attacker who manipulates the sender.id argument can trigger disclosure of stored Time-based One-Time Password (TOTP) secrets. The vulnerability is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor) and requires local access to exploit. A public exploit has been made available, and the vendor was contacted prior to disclosure.

Critical Impact
Local attackers can extract stored TOTP secrets from the 2FA Authenticator Extension by sending crafted external messages with a spoofed sender.id value.

Affected Products

extension.vn 2FA Authenticator Extension 1.0.0.2
Google Chrome (as the extension host browser)
Any Chromium-based browser loading the vulnerable extension build

Discovery Timeline

2026-08-31 - CVE-2026-82810 published to the National Vulnerability Database (NVD)
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-82810

Vulnerability Analysis

The extension.vn 2FA Authenticator Extension registers an external message handler in its Background Service Worker using chrome.runtime.onMessageExternal.addListener. This listener accepts messages from other extensions or web pages declared in the externally_connectable manifest field. The handler fails to properly restrict which senders may request stored TOTP secrets, relying on attacker-influenced values within the sender object to make authorization decisions.

When an attacker with local access issues a crafted external message and controls the sender.id parameter as reflected to the listener, the extension responds with stored TOTP seed material. Because TOTP secrets are the underlying seeds used to derive multifactor authentication codes, disclosure permanently undermines the second factor for every account provisioned in the extension.

Root Cause

The root cause is improper access control in the external message handler. The listener does not enforce a strict allowlist of trusted extension IDs and does not treat sender.id as untrusted attacker-controlled input. This design allows unauthorized callers to reach code paths that read and return sensitive stored secrets from the extension's storage backend.

Attack Vector

Exploitation requires local access and low privileges on the host system. An attacker leverages a locally installed extension, a controlled web origin listed in externally_connectable, or another process able to reach the extension messaging channel. The attacker sends a message to the vulnerable extension while manipulating the sender.id argument, and the listener responds with the stored TOTP secrets. No user interaction is required. Refer to the GitHub Extension Vulnerability Report and the VulDB CVE-2026-82810 entry for the published proof of concept.

Detection Methods for CVE-2026-82810

Indicators of Compromise

Presence of the extension.vn 2FA Authenticator Extension version 1.0.0.2 in Chrome extension inventories.
Unexpected extensions installed on user endpoints that declare externally_connectable permissions targeting the 2FA Authenticator extension ID.
Anomalous outbound traffic from browser processes shortly after installation of unknown local extensions or scripts.

Detection Strategies

Inventory installed browser extensions across managed endpoints and flag any host running extension.vn 2FA Authenticator 1.0.0.2.
Review Chrome enterprise policy reports for extensions with externally_connectable manifest fields that reference third-party 2FA extension IDs.
Correlate account takeover attempts or MFA replay events against endpoints where the vulnerable extension was previously installed.

Monitoring Recommendations

Enable browser extension telemetry through Chrome Enterprise reporting and forward events to a centralized log platform.
Alert on installation of new Chrome extensions on endpoints owned by users with access to sensitive TOTP-protected accounts.
Monitor authentication logs for MFA code reuse or logins from unexpected geographies following suspected extension compromise.

How to Mitigate CVE-2026-82810

Immediate Actions Required

Uninstall extension.vn 2FA Authenticator Extension 1.0.0.2 from all managed Chrome browsers until a patched version is confirmed.
Rotate every TOTP secret provisioned in the extension and re-enroll the affected accounts with a trusted authenticator.
Audit accounts that relied on the extension for MFA and review recent authentication activity for signs of misuse.

Patch Information

At the time of publication, no vendor-supplied patched version is referenced in the NVD entry or VulDB Vulnerability #397229. Administrators should track vendor updates on the Chrome Web Store listing and apply a fixed release as soon as it is available. Until then, treat the extension as unsafe on all endpoints.

Workarounds

Block installation of the affected extension ID through Chrome Enterprise policy using an extension blocklist.
Restrict extension installation to a curated allowlist managed by IT to prevent reintroduction of the vulnerable build.
Migrate users to a vetted authenticator application or hardware security key for MFA generation.

bash

# Chrome Enterprise policy example: block the vulnerable extension by ID
# Replace <EXTENSION_ID> with the extension.vn 2FA Authenticator ID from the Chrome Web Store
{
  "ExtensionInstallBlocklist": [
    "<EXTENSION_ID>"
  ],
  "ExtensionInstallAllowlist": [
    "approved_extension_id_1",
    "approved_extension_id_2"
  ]
}