CVE-2026-82811

CVSS 5.4 (medium) · published 2026-08-31

A security vulnerability has been detected in Toggl OÜ Toggl Track Extension up to 4.11.21. This affects an unknown function of the component postMessage Handler. The manipulation leads to origin validation error. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 4.11.22 mitigates this issue. Upgrading the affected component is advised. The vendor confirms, that "[i]t was fixed in 4.11.21 on Chrome and 4.11.22 on Firefox."

Weakness: CWE-345, CWE-346

Source: NVD CVE-2026-82811

References

• https://github.com/xryj920/chrome_extensions/blob/main/Toggl%20O%C3%9C%20Toggl%20Track%204.11.16%20accepts%20forged%20session-state%20messages%20through%20an%20unauthenticated%20postMessage%20handler
• https://vuldb.com/cve/CVE-2026-82811
• https://vuldb.com/submit/875273
• https://vuldb.com/vuln/397230
• https://vuldb.com/vuln/397230/cti

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.