Executive brief
The extension.vn 2FA Authenticator Chrome extension stores TOTP (time-based one-time password) secrets that are used to protect user accounts with two-factor authentication. A vulnerability in the extension's message handling allows a malicious co-installed browser extension to read these stored TOTP secrets without authorization. Once stolen, an attacker can generate valid authentication codes independently, potentially gaining access to protected accounts even if the user changes their password.
Technical details
The vulnerability is an improper external message authorization flaw (CWE-862, CWE-200) in the background service worker. The extension registers chrome.runtime.onMessageExternal.addListener without validating the sender's extension ID, allowing any co-installed extension to send messages. The handler accepts a "get_data_storage" request and returns TOTP secrets stored under "list_secret_key_2fa" without authorization checks. Attack requires local access (malicious co-installed extension) and results in disclosure of long-lived TOTP shared secrets. The vendor confirmed the issue and stated that a patched version removing onMessageExternal and adding sender validation was in preparation.
Affected products
- extension.vn 2FA Authenticator 1.0.0.2
Timeline
- 2026-08-31: disclosed
- other: Exploit made public