CVE-2019-9150

—

CVSS 3.0

5.3 medium

EPSS

1%p70

Published

Jul 9, 2019 (Jul 9, 2019)

Modified

Jun 17, 2026

Description

Mailvelope prior to 3.3.0 does not require user interaction to import public keys shown on web page. This functionality can be tricked to either hide a key import from the user or obscure which key was imported.

Vendors: mailvelope
Products: mailvelope
Weakness: CWE-320
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (1.4%)

In the news0 stories

No ingested article mentions this CVE yet.