CVE-2026-35467 — Private Key stored as extractable in browser IndexeDB
The stored API keys in temporary browser client is not marked as protected allowing for JavScript console or other errors to allow for extraction of the encryption credentials.
Published: 2026-04-02 · CVSS: 7.5 · CVSS 3.1
The stored API keys in temporary browser client is not marked as protected allowing for JavScript console or other errors to allow for extraction of the encryption credentials.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7