Cybersecurity researchers have revealed a critical vulnerability in N-able’s PassPortal browser extension that could have allowed a malicious website or embedded iframe to obtain authentication materials and take control of a user’s password vault.
This vulnerability, tracked as CVE-2026-15580, affects PassPortal version 3.49.5 and has a CVSS v4.0 base score of 9.4. It was patched in version 3.49.6.
The flaw exposed access and refresh tokens that could grant access to the vault for up to 100 days, potentially affecting over 73,000 active users. N-able deployed fixes for its Chrome and Microsoft Edge extensions within 24 hours of receiving the disclosure.
N-Able PassPortal Extension Flaw
The root of the problem lay in unsafe cross-context communication between PassPortal’s content script and an iframe hosted by the extension that was used to present password suggestions.
The content script listened for window.postMessage events in the page’s main execution environment and trusted requested methods without verifying the sender’s origin.
As a result, any page a logged-in user visited could request sensitive session data and receive the response. Researchers noted that the information returned included an access token and a refresh token, the latter of which allowed continued access even after the short-lived access token expired.
An attacker would not need to compromise the PassPortal service itself; simply luring a user to attacker-controlled content could trigger exposure.
PassPortal’s architecture amplified this vulnerability. According to the disclosure, password and time-based one-time password (TOTP) decryption occurred on the server side rather than exclusively on the customer’s device.
Consequently, the extension supplied key-related materials with requests for credentials and TOTP codes. Researchers discovered organization key data and a phrase encoded within the JWT access token.
While JSON Web Tokens (JWTs) provide integrity protection, they do not inherently conceal their contents, making the exposure of sensitive material particularly concerning.
Once stolen, the exposed tokens could be used to enumerate vault records, retrieve decrypted passwords, obtain live TOTP values, and refresh sessions to access resources. The result was complete CRUD (Create, Read, Update, Delete) capabilities across the affected vaults.
N-able’s response to this issue was notably swift. The researchers from Am I Being Pwned contacted the company on July 6, 2026, after an automated pipeline identified the potentially dangerous messaging pattern.
N-able provided a test account on July 8, allowing validation and submission of a complete report. A patched extension was made available on the Chrome Web Store and Microsoft Edge Add-ons store on July 9.
The revised message handler calculates the extension’s origin, rejects messages from unverified origins, checks that the sender is a trusted frame, and validates a nonce before dispatching sensitive methods. These controls prevent arbitrary websites and page-controlled iframes from utilizing the extension’s privileged message channel.
This incident highlights the crucial need for browser extensions that handle credentials to isolate privileged functionality from untrusted web content strictly. While origin validation is a vital immediate safeguard, it is not a substitute for designing a minimal attack surface.
Researchers recommended replacing window.postMessage communication with Chrome’s or Edge’s extension messaging mechanisms, which should be configured to prevent web pages from accessing internal channels.
They also urged N-able to consider a long-term redesign featuring end-to-end encryption, in which decryption occurs on the client side, ensuring that the service infrastructure never receives sufficient information to reconstruct plaintext vault data.
For administrators, the priority should be to update immediately, review extension versions, and promptly monitor for any suspicious vault activity.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
