CVE-2026-35467

Private Key stored as extractable in browser IndexeDB PUBLISHED

Description (CNA)

The stored API keys in temporary browser client is not marked as protected allowing for JavScript console or other errors to allow for extraction of the encryption credentials.

Affected (CNA)

Vendor / product	Versions
CERT/CC / cveClient/encrypt-storage.js	affected 0 before 1.1.15

CWE

CWE-522

References

https://github.com/CERTCC/cveClient/pull/39
https://github.com/CERTCC/cveClient/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.