Executive brief
vidIQ Vision for YouTube is a Chrome browser extension used to analyze YouTube video performance and analytics. A flaw in the extension allows any web page to request and receive still frame captures of videos currently being watched by the user, including private or restricted content, without proper authentication or origin verification. This could expose sensitive video content the user is authorized to view but intended to keep private.
Technical details
The vulnerability is a missing origin validation flaw (CWE-346) in the extension's postMessage handler on YouTube pages. The content script listens for messages with vidiqEvent: "getVideoStill" but fails to validate event.origin before extracting the current video frame, converting it to a base64-encoded image, and sending it back to the message sender. An attacker with script execution capability in a context that can message the YouTube page (e.g., a malicious frame, compromised extension, or vulnerable script on YouTube) can remotely capture video frames without authorization. The extension will respond to any origin, creating an information disclosure channel for video content. The vendor has not provided a remediation timeline or technical confirmation of the fix.
Affected products
- vidIQ Inc. vidIQ Vision for YouTube 3.199.0
Timeline
- 2026-08-31: disclosed: Vulnerability publicly disclosed via GitHub
- 2026-08-31: other: Exploit code released to public