N-able has patched a critical vulnerability in its Passportal browser extension that could have allowed malicious websites or attacker-controlled embedded iframes to steal authentication tokens and maintain access to a victim’s decrypted password vault.
Tracked as CVE-2026-15580, the issue affected Passportal extension version 3.49.5 for Google Chrome and Microsoft Edge.
The vulnerability received a CVSS v4.0 score of 9.4 and was fixed in version 3.49.6, reportedly released within 24 hours of N-able receiving the disclosure.
N-able Patches Critical Passportal Flaw
The extension had more than 73,000 weekly active users, creating substantial potential exposure for managed service providers (MSPs), IT teams, and their downstream customers.
The flaw originated in Passportal’s browser-extension messaging flow. The extension used window.postMessage to exchange data between a webpage content script and a Passportal popover iframe, an implementation pattern that can be secure only when it strictly verifies the sender’s origin, source window, and message context.
In the affected version, the content script reportedly accepted messages from arbitrary origins and dispatched functions based on attacker-controlled message data. This meant a malicious page could issue a request resembling:
window.postMessage({ method: "getPasswords" }, "*")If a logged-in Passportal user visited the page, the extension could return sensitive session data instead of rejecting the untrusted request. The attack required user interaction in the form of visiting a malicious site, but did not depend on a phishing login page, malware installation, or a compromised Passportal account.
The exposed data reportedly included access and refresh tokens used by the extension to communicate with Passportal’s backend APIs.
Unlike a conventional password-manager autofill flaw, where exposure may be limited to credentials tied to a specific website, the stolen tokens could enable access to the broader password-management API and the victim’s stored vault content.
Researchers said the refresh token could remain valid for up to 100 days. That persistence window would allow an attacker to retain access long after the victim closed the malicious webpage or restarted their browser, transforming a one-time browser messaging weakness into a sustained vault-compromise scenario.
The risk is especially acute in MSP environments. A Passportal vault may contain administrative credentials, tenant infrastructure access, customer documentation, API keys, recovery codes, and TOTP secrets. A single compromised administrator could therefore expose multiple client organizations and create a supply-chain-style incident.
The researchers also raised concerns about Passportal’s decryption model. Password requests appeared to be handled server-side, with decrypted password values and TOTP codes returned to the browser extension. The reported access token also contained key-related fields described as an organization key and phrase.
JWTs provide integrity protection, but they are not encrypted by default. Including sensitive cryptographic material in a bearer token can magnify the impact of token theft because anyone who obtains a valid token may be able to inspect its contents and reuse it until it expires or is revoked.
N-able’s update restricts sensitive extension messages to the trusted extension origin. The patched handler also validates the sender frame and checks a nonce before processing requests. The vendor provided a test account on July 8, received the full technical report, and deployed the fix on July 9, according to the disclosure timeline.
Organizations using Passportal should take the following actions immediately:
- Update Chrome and Edge Passportal deployments to version 3.49.6 or later.
- Identify endpoints that used version 3.49.5 and verify extension-update compliance.
- Review Passportal vault and API activity for unexpected access, token use, or credential retrieval.
- Invalidate active sessions and revoke refresh tokens where operationally feasible.
- Rotate privileged passwords, API secrets, break-glass accounts, and TOTP seeds if vulnerable users may have visited untrusted sites.
- Alert MSP customers if shared administrator vaults or tenant credentials may have been exposed.
Although the patch closes the unauthenticated cross-origin messaging path, organizations should treat potential exposure as a high-impact identity and credential incident due to the possibility of long-lived token theft and vault-wide access.
No Comment! Be the first one.