ZeroDay Findings
Sign inSign up

Findings

CVE-2026-45244

Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows attackers to execute browser automation actions without per-call user approval whe…

Published May 18, 2026 · updated Oct 14, 2026 · steipete summarize

Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows attackers to execute browser automation actions without per-call user approval when the extension automation feature is enabled. Attackers can influence the agent through malicious page or summary content to invoke enabled extension automation tools such as navigation or debugger-backed actions, bypassing the final user approval step when a user interacts with attacker-controlled content.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. May 18, 2026 · NIST NVD

    Detected

    Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows attackers to execute browser automation actions without per-call user approval when the extension automation feature is enabled. Attackers can influence the agent through malicious page or summary content to invoke enabled extension automation tools such as navigation or debugger-backed actions, bypassing the fina

  2. Oct 14, 2026 · NIST NVD

    Updated

    Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows attackers to execute browser automation actions without per-call user approval when the extension automation feature is enabled. Attackers can influence the agent through malicious page or summary content to invoke enabled extension automation tools such as navigation or debugger-backed actions, bypassing the fina

Affected

  • cpe steipete/summarizeversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-45244

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-45244

    30-day exploitation probability 0.4%

    first.org
  • NIST NVDVulnerability recordCVE-2026-45244

    Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows attackers to execute browser automation actions without per-call user approval when the extension automation feature is enabled. Attackers can influence the agent through malicious page or summar

    nvd.nist.gov

References