MouseTooltipTranslator Chrome Extension Server-Side Request Forgery Vulnerability

A server-side request forgery (SSRF) vulnerability has been identified in the MouseTooltipTranslator Chrome extension, version 0.1.127. This vulnerability allows an attacker to manipulate the extension into sending requests to arbitrary URLs. The issue arises because the 'pdf.mjs' script, which is vulnerable to SSRF, is imported into 'viewer.html'. Since 'viewer.html' can be accessed from any URL, an attacker can exploit this to make requests from the user's browser to potentially harmful locations.

Impact

Exploitation of this vulnerability could lead to privilege escalation, allowing an attacker to access and manipulate resources on a local server that are assumed to be safe due to network segmentation.