What’s Vulnerable › Vulnerabilities

CVE-2019-9147

• Severity: medium (CVSS 4.3 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-07-09 · updated 2026-06-17
• Weakness: CWE-1021

Description

Mailvelope prior to 3.1.0 is vulnerable to a clickjacking attack against the settings page. As the settings page is intended to be accessible from web applications, the browser's extension isolation mechanisms are disabled (web_accessible_resources). Mailvelope implements additional measures to prevent web applications from directly embedding the settings page, but this mechanism can be bypassed.

Affected products

• Mailvelope: before 3.1.0 — fixed in 3.1.0

How to fix

Upgrade to a fixed version: Mailvelope 3.1.0. Check the vendor advisory for mitigations.

References

• https://github.com/mailvelope/mailvelope/blob/master/Changelog.md#v310
• https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html
• https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.pdf?__blob=publicationFile&v=3
• https://github.com/mailvelope/mailvelope/blob/master/Changelog.md#v310
• https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html
• https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.pdf?__blob=publicationFile&v=3

Get alerted when CVE-2019-9147 or the next vulnerability affects your stack