Skip to content
Heist/ feed
Back to feed
Medium

Security advisory

Type: advisorySources: OSVCVE: CVE-2019-9147

Mailvelope prior to 3.1.0 is vulnerable to a clickjacking attack against the settings page. As the settings page is intended to be accessible from web applications, the browser's extension isolation mechanisms are disabled (web_accessible_resources). Mailvelope implements additional measures to prevent web applications from directly embedding the settings page, but this mechanism can be bypassed.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2019-9147
Confirmed fixed CVEs
Not specified
Updated in this feed
31 Oct 2026, 10:48 UTC · Revision 1

Source evidence

CVE-2019-9147

core-osv · Original source

Published 9 Jul 2019, 21:15 UTC

Mailvelope prior to 3.1.0 is vulnerable to a clickjacking attack against the settings page. As the settings page is intended to be accessible from web applications, the browser's extension isolation mechanisms are disabled (web_accessible_resources). Mailvelope implements additional measures to prevent web applications from directly embedding the settings page, but this mechanism can be bypassed.

osv:CVE-2019-9147
Complete source record
{
  "id": "2f413dcea39275186ba7f961b22c6d7282b63748219a50078ea61b61c26f3ecf",
  "url": "https://osv.dev/vulnerability/CVE-2019-9147",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2019-9147",
    "summary": "Mailvelope prior to 3.1.0 is vulnerable to a clickjacking attack against the settings page. As the settings page is intended to be accessible from web applications, the browser's extension isolation mechanisms are disabled (web_accessible_resources). Mailvelope implements additional measures to prevent web applications from directly embedding the settings page, but this mechanism can be bypassed.",
    "evidence": "osv:CVE-2019-9147",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2019-9147",
      "aliases": [
        "CVE-2019-9147"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/mailvelope/mailvelope",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "ba9540cb7378a4f875ef66b2280387aa06527d2c"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:mailvelope:mailvelope:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "3.1.0"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v3.0.2",
            "v3.0.1",
            "v3.0.0",
            "v2.2.2",
            "v2.2.1",
            "v2.2.0",
            "v2.1.1",
            "v2.1.0",
            "v2.0.0",
            "v1.8.1",
            "v1.8.0",
            "v1.7.2",
            "v1.7.1",
            "v1.6.5",
            "v1.6.0",
            "v1.5.2",
            "v1.5.1",
            "v1.4.0",
            "v1.3.6",
            "v1.3.4",
            "v1.3.3",
            "v1.3.2",
            "v1.3.1",
            "v1.3.0",
            "v1.2.3",
            "v1.2.2",
            "v1.2.0",
            "v1.1.0",
            "v1.0.2",
            "v1.0.1",
            "v1.0.0",
            "v0.13.2",
            "v0.13.1",
            "v0.13.0",
            "v0.13.0b11",
            "v0.13.0b10",
            "v0.13.0b9",
            "v0.13.0b8",
            "v0.13.0b7",
            "v0.13.0b6",
            "v0.13.0b5",
            "v0.13.0b4",
            "v0.13.0b3",
            "v0.13.0b2",
            "v0.13.0b1",
            "v0.12.0b3",
            "v0.12.0b2",
            "v0.12.0b1",
            "v0.10.2",
            "v0.10.0",
            "v0.10.0b1",
            "v0.9.0",
            "v0.8.2",
            "v0.8.1",
            "v0.8.0",
            "v0.8.0b1",
            "v0.7.0",
            "v0.7.0b3",
            "v0.7.0b2",
            "v0.7.0b1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-9147.json"
          }
        }
      ],
      "modified": "2026-10-20T10:51:44.551758309Z",
      "provider": "osv",
      "references": [
        "https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html",
        "https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.pdf?__blob=publicationFile&v=3",
        "https://github.com/mailvelope/mailvelope/blob/master/Changelog.md#v310"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2019-9147",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 382842,
  "published_at": "2019-07-09T21:15:11.193+00:00"
}