CVE-2026-45243
Summarize < 0.15.1 Browser Extension Missing Authorization via Content Script
CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
7th
Summarize prior to 0.15.1 contains a missing authorization vulnerability in the content script window.postMessage bridge that allows malicious pages to perform unauthorized operations on automation artifacts. Attackers can simulate runtime messages with spoofed sender identifiers to list, read, create, overwrite, or delete automation artifacts scoped to the affected tab without proper authorization checks.
| CWE | CWE-862 |
| Vendor | steipete |
| Product | summarize |
| Published | May 18, 2026 |
| Last Updated | May 19, 2026 |
Stay Ahead of the Next One
Get instant alerts for steipete summarize
Be the first to know when new medium vulnerabilities affecting steipete summarize are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
steipete / summarize
0 < 0.15.1
References
github.com: https://github.com/steipete/summarize/releases/tag/v0.15.2 github.com: https://github.com/steipete/summarize/pull/222 github.com: https://github.com/steipete/summarize/commit/357544063af535bd574752622f9eb94be33ee5fd vulncheck.com: https://www.vulncheck.com/advisories/summarize-browser-extension-missing-authorization-via-content-script
Credits
Chia Min Jun Lennon