CVE-2026-54565 in rhwp
Summary
by MITRE • 09/17/2026
rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions use an all-URLs host permission to detect HWP and HWPX links on visited pages, but the service workers do not validate message senders, URL schemes, or destination addresses before privileged fetches. The affected paths are rhwp-chrome/manifest.json, rhwp-chrome/content-script.js, rhwp-chrome/sw/message-router.js, rhwp-chrome/sw/thumbnail-extractor.js, rhwp-firefox/manifest.json, rhwp-firefox/content-script.js, rhwp-firefox/sw/message-router.js, and rhwp-firefox/sw/thumbnail-extractor.js. An untrusted page can make the fetch-file and extract-thumbnail handlers request localhost or private-network resources. When a target HWP or HWPX file contains an extractable PrvImage, the extension returns the preview as a data URI in page-readable DOM, allowing page script to read it. The flaw also permits internal-resource existence and port probing and extension presence or version fingerprinting. Exploitation requires a user to visit an untrusted page while the extension is enabled, and preview disclosure is limited to an extractable PrvImage. This issue is fixed in rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in the rhwp browser extensions for Chrome and Firefox stems from a critical misconfiguration of service worker security policies combined with insufficient input validation during privileged network operations. The rhwp tool, which serves as an HWP viewer and editor implemented using Rust and WebAssembly, relies on browser extensions to detect specific file types such as HWP and HWPX within web pages. To facilitate this detection prior to version 0.7.15 of the core library and versions 0.2.4 of the respective browser extensions, the service workers were granted all-URLs host permissions. This broad permission set was intended to allow the extension to intercept and process links across any domain visited by the user. However, this architectural decision introduced a severe security flaw because the service workers failed to validate message senders, URL schemes, or destination addresses before executing privileged fetch requests. Consequently, an attacker could craft malicious web pages that exploit these unchecked pathways to force the browser extension into making network requests on behalf of the untrusted context.
From a technical perspective, the core issue lies in the lack of origin validation within the message routing logic found in files such as sw/message-router.js and sw/thumbnail-extractor.js for both Chrome and Firefox variants. When an untrusted page sends messages to trigger handlers like fetch-file or extract-thumbnail, the service worker processes these requests without verifying that they originate from a trusted source or are directed at safe endpoints. This absence of validation allows malicious scripts running on any visited webpage to instruct the extension to perform HTTP GET requests against localhost addresses or other private network resources. Such behavior effectively bypasses standard browser same-origin policies for the duration of the service worker's execution, enabling internal resource discovery and port probing attacks. The affected code paths include manifest.json configurations that grant excessive permissions as well as the content scripts responsible for injecting detection logic into web pages.
The operational impact of this vulnerability is multifaceted, ranging from information disclosure to potential network reconnaissance. By forcing the extension to fetch resources from localhost or private networks, an attacker can determine the existence and versioning of internal services running on the user's local machine or corporate intranet. This capability facilitates port probing and service fingerprinting, which are often precursors to more targeted attacks against vulnerable internal applications. Furthermore, if a target HWP or HWPX file contains an extractable PrvImage component, the extension returns the preview as a data URI embedded in page-readable DOM elements. Since this data is exposed within the Document Object Model of the untrusted webpage, arbitrary scripts running on that page can read and exfiltrate the image content. This represents a direct violation of confidentiality for sensitive documents processed by the user through the rhwp extension.
This vulnerability aligns with CWE-20 Improper Input Validation, specifically regarding the failure to validate origin or source of incoming messages in service workers. It also maps to ATT&CK technique T1568 Dynamic Resolution, as it allows an attacker to resolve and interact with internal network resources that are typically inaccessible from external web contexts. Additionally, the exposure of document previews via DOM manipulation relates to CWE-200 Exposure of Sensitive Information to an Unauthorized Actor. The exploitation scenario requires a user to visit a malicious or compromised webpage while the rhwp extension is enabled in their browser. While the scope of data leakage is limited to extractable PrvImage components and network metadata, the ability to probe internal infrastructure significantly increases the attack surface for lateral movement within protected networks where users may be accessing sensitive corporate documents via this tool.
Mitigation strategies focus on applying the vendor-released patches immediately. Users must upgrade rhwp to version 0.7.15 or later and update their Chrome and Firefox extensions to version 0.2.4 or higher. These updates address the root cause by implementing strict validation of message senders, ensuring that only trusted origins can trigger privileged operations within the service workers. Furthermore, developers should enforce Content Security Policy (CSP) directives that restrict data URI usage in DOM elements where sensitive information is processed and ensure that host permissions are scoped narrowly to specific domains rather than using wildcard all-URLs access unless absolutely necessary for functionality. For organizations deploying this tool internally, it is advisable to monitor extension activity logs if available and educate users on the risks of enabling document preview extensions while browsing untrusted websites until patches are fully deployed across all client environments.