CVE-2019-9147

Mailvelope prior to 3.1.0 is vulnerable to a clickjacking attack against the settings page. As the settings page is intended to be accessible from web applications, the browser's extension isolation mechanisms are disabled (web_accessible_resources). Mailvelope implements additional measures to prevent web applications from directly embedding the settings page, but this mechanism can be bypassed.

• CWE-1021

• https://github.com/mailvelope/mailvelope/blob/master/Changelog.md#v310Release Notes, Third Party Advisory
• https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html
• https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.pdf?__blob=publicationFile&v=3
• https://github.com/mailvelope/mailvelope/blob/master/Changelog.md#v310Release Notes, Third Party Advisory
• https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.html
• https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Mailvelope_Extensions/Mailvelope_Extensions_pdf.pdf?__blob=publicationFile&v=3

Published

Jul 9, 2019

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-9141ZInsVX.dll ActiveX Control 2018.02 and earlier in Zoneplayer…9.8
• CVE-2019-9142An issue was discovered in b3log Symphony (aka Sym) before v…
• CVE-2019-9143An issue was discovered in Exiv2 0.27. There is infinite rec…
• CVE-2019-9144An issue was discovered in Exiv2 0.27. There is infinite rec…
• CVE-2019-9145An issue was discovered in Hsycms V1.1. There is an XSS vuln…
• CVE-2019-9146Jamf Self Service 10.9.0 allows man-in-the-middle attackers …
• CVE-2019-9148Mailvelope prior to 3.3.0 accepts or operates with invalid P…4.3
• CVE-2019-9149Mailvelope prior to 3.3.0 allows private key operations with…6.5
• CVE-2019-9150Mailvelope prior to 3.3.0 does not require user interaction …
• CVE-2019-9151An issue was discovered in the HDF HDF5 1.10.4 library. Ther…
• CVE-2019-9152An issue was discovered in the HDF HDF5 1.10.4 library. Ther…
• CVE-2019-9153Improper Verification of a Cryptographic Signature in OpenPG…