CVE-2026-82813: TubeBuddy for YouTube Extension RCE Vulnerability

CVE-2026-82813 Overview

CVE-2026-82813 affects the BEN Group TubeBuddy for YouTube Chrome extension up to version 5.8.4. The vulnerability resides in the TBGlobal.GetToken function within tubebuddymaster1.js. Manipulation of the t, c, or r arguments leads to insufficient verification of data authenticity [CWE-345], allowing an authentication token overwrite through an unauthenticated redirect URL handler. Attackers can trigger the issue remotely, and the exploit has been published. The vendor was notified prior to public disclosure.

Critical Impact

Remote attackers can overwrite a victim's authentication token in the TubeBuddy extension by tricking the user into interacting with a crafted URL, enabling limited integrity and availability impact on the affected browser session.

Affected Products

• BEN Group TubeBuddy for YouTube Chrome extension versions up to and including 5.8.4
• Google Chrome installations with the vulnerable extension enabled
• Chromium-based browsers running the same extension package

Discovery Timeline

• 2026-08-31 - CVE-2026-82813 published to NVD
• 2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-82813

Vulnerability Analysis

The flaw is an insufficient verification of data authenticity issue in a client-side Chrome extension. The TBGlobal.GetToken function inside tubebuddymaster1.js accepts parameters (t, c, r) supplied through a redirect URL handler without validating their origin or authenticity. As a result, an attacker-controlled input path can influence which authentication token the extension stores and subsequently uses for authenticated API interactions.

Because the redirect handler is unauthenticated, no session, signature, or origin check gates the token write. This turns a routine OAuth-style redirect flow into a client-side token injection primitive, and the exploit code has been disclosed publicly.

Root Cause

The root cause is missing authenticity validation on inbound token material [CWE-345]. The extension trusts URL parameters passed to TBGlobal.GetToken and writes them into its token store without verifying that the values originate from a legitimate authentication response. There is no state parameter check, no origin binding, and no cryptographic verification of the returned token payload.

Attack Vector

Exploitation requires user interaction. An attacker crafts a URL that invokes the extension's redirect handler with attacker-supplied t, c, or r values. When the victim visits the link, the extension overwrites its stored authentication token with the attacker-supplied value. Subsequent extension-driven requests execute in the context of the injected token, which can enable session confusion, disruption of the victim's account state, or manipulation of extension behavior.

No authentic code example is available for this CVE. Refer to the GitHub Security Vulnerability Report and the VulDB entry for CVE-2026-82813 for the disclosed technical details.

Detection Methods for CVE-2026-82813

Indicators of Compromise

• Browser navigations to TubeBuddy redirect endpoints containing unexpected t, c, or r query parameters originating from external referrers.
• Sudden changes to the extension's stored authentication token in Chrome extension storage without a preceding legitimate login flow.
• Outbound API calls from the TubeBuddy extension to app.tubebuddy.com using tokens that do not correspond to the user's active session.

Detection Strategies

• Inspect browser telemetry and web proxy logs for URL patterns invoking TBGlobal.GetToken parameters from off-origin sources.
• Correlate extension installation inventory against the vulnerable version range (up to 5.8.4) using endpoint management tooling.
• Alert on anomalous account activity for TubeBuddy-linked YouTube accounts, particularly authentication state changes shortly after users click external links.

Monitoring Recommendations

• Enable extension inventory reporting through Chrome Enterprise policies to track TubeBuddy versions across managed endpoints.
• Monitor DNS and HTTP logs for requests to TubeBuddy authentication endpoints followed by unusual redirect chains.
• Review browser console and extension error telemetry for repeated token write operations against tubebuddymaster1.js.

How to Mitigate CVE-2026-82813

Immediate Actions Required

• Update the TubeBuddy for YouTube Chrome extension to a version later than 5.8.4 as soon as the vendor publishes a fix.
• Force revocation and reissuance of TubeBuddy authentication tokens for users who may have followed untrusted links.
• Advise users to avoid clicking TubeBuddy-related redirect URLs delivered through email, chat, or untrusted web content until patched.

Patch Information

No fixed version is listed in the NVD entry at time of publication. Track the VulDB advisory for CVE-2026-82813 and the vendor's Chrome Web Store listing for a patched release above 5.8.4. Apply the update through Chrome's extension auto-update mechanism or by pushing the new version through enterprise extension management.

Workarounds

• Disable or remove the TubeBuddy for YouTube extension until a patched release is available.
• Restrict installation of the extension using Chrome Enterprise ExtensionInstallBlocklist policy for the affected extension ID.
• Instruct affected users to sign out of TubeBuddy and clear extension storage to invalidate any previously injected tokens.

# Chrome Enterprise policy example to block the vulnerable extension
# Replace <EXTENSION_ID> with the TubeBuddy Chrome Web Store ID
cat <<EOF > /etc/opt/chrome/policies/managed/block_tubebuddy.json
{
  "ExtensionInstallBlocklist": [
    "<EXTENSION_ID>"
  ]
}
EOF