CVE-2026-45244
Summarize < 0.15.1 Unapproved Browser Automation Execution
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows attackers to execute browser automation actions without per-call user approval when the extension automation feature is enabled. Attackers can influence the agent through malicious page or summary content to invoke enabled extension automation tools such as navigation or debugger-backed actions, bypassing the final user approval step when a user interacts with attacker-controlled content.
| CWE | CWE-862 |
| Vendor | steipete |
| Product | summarize |
| Published | May 18, 2026 |
| Last Updated | May 19, 2026 |
Stay Ahead of the Next One
Get instant alerts for steipete summarize
Be the first to know when new medium vulnerabilities affecting steipete summarize are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
steipete / summarize
0 < 0.15.1
References
github.com: https://github.com/steipete/summarize/releases/tag/v0.15.2 github.com: https://github.com/steipete/summarize/pull/219 github.com: https://github.com/steipete/summarize/commit/e64fe3ecd1bb4fdc181dcfa88c96b9e1914ced0e vulncheck.com: https://www.vulncheck.com/advisories/summarize-unapproved-browser-automation-execution
Credits
Chia Min Jun Lennon