The background service worker in extension.vn 2FA Authenticator Extension 1.0.0.2 exposes a flaw in the chrome.runtime.onMessageExternal.addListener handler. By manipulating the argument sender.id, an attacker with local access can trigger the listener to return a stored TOTP secret. The weakness directly results in the disclosure of credentials that the extension stores for two‑factor authentication, compromising the confidentiality of the user’s secrets.

This weakness is limited to the specified Chrome extension, extension.vn 2FA Authenticator Extension version 1.0.0.2. No other products or versions are currently documented as affected. The vulnerability only exists on Google Chrome for which this extension is distributed via the Chrome Web Store.

The CVSS base score is 4.8, indicating moderate risk; no EPSS value is reported and it is not part of the CISA KEV catalogue. The attack requires local access, so the threat model is confined to users who can run code on the victim machine. An attacker could read the TOTP secrets and use them for account takeover. The weakness maps to CWE‑200 (Sensitive Data Exposure) and CWE‑284 (Improper Access Control).