The vulnerability resides in the window.addEventListener implementation of the postMessage handler in the vidIQ Vision for YouTube Chrome extension. By manipulating the “vidiqEvent” argument, an attacker can read data that should be protected, exposing user information. This flaw is an Information Disclosure weakness (CWE‑200) combined with inadequate access control (CWE‑284). The attacker can remotely obtain data from the extension’s environment, but the flaw does not provide code execution or privilege escalation.

The affected product is the vidIQ Vision for YouTube Extension for Chrome version 3.199.0. Any user who has installed this specific extension under the Chrome browser is potentially exposed. The vulnerability exists within the extension’s JavaScript and does not affect other Chrome extensions or the browser itself.

The CVSS score of 5.3 indicates a moderate risk. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited known exploitation. Nevertheless, the exploit has been released publicly and can be performed remotely by sending a crafted postMessage event to the extension’s context. Attackers would need the extension installed and a valid postMessage trigger, but no additional software prerequisite is required.