What’s Vulnerable › Vulnerabilities

CVE-2019-9150

• Severity: medium (CVSS 5.3 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-07-09 · updated 2026-06-17
• Weakness: CWE-320

Description

Mailvelope prior to 3.3.0 does not require user interaction to import public keys shown on web page. This functionality can be tricked to either hide a key import from the user or obscure which key was imported.

Affected products

• Mailvelope: before 3.3.0 — fixed in 3.3.0

How to fix

Upgrade to a fixed version: Mailvelope 3.3.0. Check the vendor advisory for mitigations.

References

• https://github.com/mailvelope/mailvelope/blob/master/Changelog.md#v330
• https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html
• https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.pdf?__blob=publicationFile&v=3
• https://github.com/mailvelope/mailvelope/blob/master/Changelog.md#v330
• https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html
• https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.pdf?__blob=publicationFile&v=3

Get alerted when CVE-2019-9150 or the next vulnerability affects your stack