CVE-2026-54565: rhwp browser extension performs SSRF / private-network requests and leaks HWP preview data to untrusted pages
rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions use an all-URLs host permission to detect HWP and HWPX links on visited pages, but the service workers do not validate message senders, URL schemes, or destination addresses before privileged fetches. The affected paths are rhwp-chrome/manifest.json, rhwp-chrome/content-script.js, rhwp-chrome/sw/message-router.js, rhwp-chrome/sw/thumbnail-extractor.js, rhwp-firefox/manifest.json, rhwp-firefox/content-script.js, rhwp-firefox/sw/message-router.js, and rhwp-firefox/sw/thumbnail-extractor.js. An untrusted page can make the fetch-file and extract-thumbnail handlers request localhost or private-network resources. When a target HWP or HWPX file contains an extractable PrvImage, the extension returns the preview as a data URI in page-readable DOM, allowing page script to read it. The flaw also permits internal-resource existence and port probing and extension presence or version fingerprinting. Exploitation requires a user to visit an untrusted page while the extension is enabled, and preview disclosure is limited to an extractable PrvImage. This issue is fixed in rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rhwpto a version that resolves this vulnerability.Fixed in 0.7.15 - Upgrade
Upgrade
rhwp Chrome and Firefox extensionto a version that resolves this vulnerability.Fixed in 0.2.4
Event History
Frequently Asked Questions
What conditions are required for exploitation?
A user must visit an untrusted web page while an affected rhwp Chrome or Firefox extension is enabled. No attacker privileges are required, and the page can trigger the vulnerable handlers through the extension's broad page access.
Which deployments should be prioritized for remediation?
Prioritize systems with the rhwp Chrome or Firefox extension installed, because the extension requests access to all URLs and can be induced to access localhost or private-network destinations. The issue affects rhwp versions before 0.7.15 and extension versions before 0.2.4.
What can be exposed to an untrusted page?
An attacker can probe for internal resources and open ports, fingerprint extension presence or version, and potentially obtain an HWP or HWPX preview. Preview disclosure requires the targeted file to contain an extractable PrvImage, which is returned in page-readable DOM as a data URI.
What can be done if updating is not immediately possible?
Disable the affected browser extension until it can be updated. Exploitation requires the extension to be enabled while the user visits an untrusted page.