CVE-2019-9150: Mailvelope

Medium severity, CVSS 5.3. EPSS: 1.4% chance of exploitation in the next 30 days.

Mailvelope prior to 3.3.0 does not require user interaction to import public keys shown on web page. This functionality can be tricked to either hide a key import from the user or obscure which key was imported.

Affected products

• Mailvelope Mailvelope: before 3.3.0 (fixed in 3.3.0)

Published 2019-07-09. Last modified 2026-06-17.