CVE-2019-9149

CVE-2019-9149 describes a vulnerability in Mailvelope prior to version 3.3.0, allowing attackers to perform private key operations without user interaction. By manipulating a URL parameter, an attacker could sign or encrypt arbitrary messages if the private key password was cached, and decrypt messages when using the GnuPG backend. This medium-severity vulnerability (CVSS 6.5) has a low attack complexity and could lead to information disclosure and integrity compromise. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.