PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45244 steipete CVE debrief

CVE-2026-45244 is a missing authorization vulnerability in Summarize, a browser extension by Steipete, affecting versions prior to 0.15.1. The vulnerability allows attackers to execute browser automation actions without per-call user approval when the extension's automation feature is enabled. Attackers can influence the agent through malicious page or summary content to invoke enabled extension automation tools such as navigation or debugger-backed actions, bypassing the final user approval step when a user interacts with attacker-controlled content. The CVSS 4.0 score of 2.1 (LOW) reflects the attack complexity requiring user interaction and the limited scope of impact. The vulnerability was disclosed on 2026-05-18 and analyzed by NVD. A patch is available in version 0.15.1, with release notes published for v0.15.2. The root cause is categorized as CWE-862 (Missing Authorization).

Vendor
steipete
Product
summarize
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-18
Original CVE updated
2026-10-08
Advisory published
2026-05-18
Advisory updated
2026-10-08

Who should care

Organizations and users deploying the Summarize browser extension with automation features enabled; security teams monitoring browser extension attack surfaces; developers of AI-assisted browser tools implementing authorization controls for automation capabilities.

Technical summary

The Summarize browser extension prior to v0.15.1 fails to enforce per-call user authorization for extension automation actions when the automation feature is enabled. An attacker can craft malicious page content or summary content that influences the agent to invoke enabled automation tools—including navigation and debugger-backed actions—without triggering the expected final user approval step. This represents a CWE-862 (Missing Authorization) weakness. The attack requires user interaction with attacker-controlled content and the precondition that automation features are enabled. The vulnerability does not directly compromise confidentiality, integrity, or availability of the extension itself, but enables unauthorized automation execution with limited scope impact on system resources.

Defensive priority

LOW

Recommended defensive actions

  • Upgrade Summarize to version 0.15.1 or later to remediate the missing authorization vulnerability
  • Review and disable extension automation features if not required for operational use
  • Implement content security policies to reduce exposure to attacker-controlled page content
  • Monitor for unauthorized browser automation actions in extension logs
  • Validate that user approval prompts are functioning correctly after patching

Evidence notes

CVE published 2026-05-18T20:16:38.390Z; modified 2026-05-19T01:34:45.673Z. NVD status: Analyzed. CVSS 4.0 vector confirms network attack vector with user interaction required. CPE indicates affected versions prior to 0.15.1.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45244 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45244

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45244 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45244

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.