Executive brief
Alaev SEO Tools is a Chrome browser extension that analyzes website SEO metadata. The extension's popup interface fails to sanitize data from web pages, allowing attackers to inject malicious scripts that execute when a user views the extension popup. This could lead to theft of sensitive information or injection of unwanted content within the browser extension context.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in the addDiv function of src/popup.html in the Popup UI component. The vulnerability arises from unsanitized page SEO fields being rendered directly into the extension popup without proper HTML encoding or sanitization. An attacker can craft a malicious web page with specially crafted SEO metadata (title, description, keywords, etc.) that, when the extension analyzes the page, injects JavaScript into the popup UI. The attack vector is network-based and requires user interaction (the user must open the extension popup while viewing a malicious page). The exploit code is publicly available. No vendor response or patch information is currently available.
Affected products
- Alaev & Co Alaev SEO Tools up to 1.0.10
Timeline
- 2026-08-17: disclosed
- other: Exploit code made public