CVE-2019-9150

CVE-2019-9150 describes a vulnerability in Mailvelope prior to version 3.3.0, where the extension could import public keys displayed on a webpage without explicit user interaction. This flaw could allow an attacker to surreptitiously import a malicious key or obscure the true key being imported, potentially leading to compromised communications. Rated as Medium severity (CVSS 5.3), it has a low attack complexity and requires no user interaction, but its impact is limited to integrity. There is no evidence of active exploitation, public exploit code, or significant community discussion, and it is not listed in CISA's KEV catalog.