The vulnerability resides in an unspecified function of the postMessage-based Bridge used by the DualSafe Password Manager & Digital Vault Extension. By manipulating the postMessage traffic, an attacker can read stored credentials and TOTP codes, compromising confidentiality. The flaw is classified under CWE‑200 (Information Exposure) and CWE‑284 (Improper Permission), indicating that sensitive data is exposed through an insecure inter‑process communication channel. While the exploit is reported as having a high complexity and considered difficult to execute, it remains a publishable attack that has already been used in the wild.

Orange View Limited’s DualSafe Password Manager & Digital Vault Extension on the Chrome browser, vulnerable in all releases up to and including version 1.4.35. No other vendors or products are known to be affected.

The public CVSS score is 2.3, indicating a low overall severity from a technical standpoint. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, leveraging the extension’s postMessage bridge, and the known exploitability is difficult. Nevertheless, the potential to expose credentials and authentication codes warrants attention, especially for users who store sensitive data in the extension.