CVE-2026-45244Disclosure(steipete / summarize)

LOWCVSS 2.1 · LOW

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows attackers to execute browser automation actions without per-call user approval when the extension automation feature is enabled. Attackers can influence the agent through malicious page or summary content to invoke enabled extension automation tools such as navigation or debugger-backed actions, bypassing the final user approval step when a user interacts with attacker-controlled content.

steipete CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

Exploit / PoC references

https://github.com/steipete/summarize/pull/219

Vendor / third-party advisories

https://www.vulncheck.com/advisories/summarize-unapproved-browser-automation-execution

Other references

https://github.com/steipete/summarize/releases/tag/v0.15.2

Weakness type (CWE)

CWE-862

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

summarize

Threat summary

3 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked at 2 mentions on most recent observed day (2026-05-20)
3 total mentions across 2 days

Affected systems

Vendors

steipete

Products

summarize

Deep dive

Activity timeline3 mentions / 2d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-18	1	Disclosure1
2026-05-20	2	Disclosure2

Full discourse3 posts

CVE@CVEnew141d
Disclosure
CVE-2026-45244 Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows attackers to execute browser automation actions without per-call user approval wh… https://www.cve.org/CVERecord?id=CVE-2026-45244
Post summary
The text reports a missing authorization vulnerability (CVE‑2026‑45244) in Selenium’s browser automation prior to version 0.15.1, describing how attackers can bypass per‑call user approval. No exploit, patch, or active use is detailed.
00010219
57.5K followersView on X
Infoflowcloud@infoflowcloud141d
Disclosure
🚨*CVE* CVE-2026-45244 Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows attackers to execute browser automation actions without per-call user approval wh… https://www.cve.org/CVERecord?id=CVE-2026-45244 ----- Traducción: CVE-2026-45244 Res… http://infoflow.cloud`
Post summary
The tweet announces CVE‑2026‑45244, outlining a missing‑authorization flaw in prior releases that allows automated browser actions without user approval, but offers no evidence of active exploitation or mitigation.
0000032
78 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds143d
Disclosure
CVE-2026-45244 Missing Authorization in Summarize Prior to 0.15.1 Allows Unauthorized Extension Automation https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-45244
Post summary
The excerpt announces a new missing‑authorization flaw in the Summarize component (prior to version 0.15.1) that permits unauthorized extension automation, without providing exploitation details or mitigation steps.
0000062
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	steipete	summarize	-	-	-

Explore more

Back to dashboard steipete CVEs summarize vulnerabilities

What researchers are saying

CVE-2026-45244

CVE@CVEnewDisclosure

The text reports a missing authorization vulnerability (CVE‑2026‑45244) in Selenium’s browser automation prior to version 0.15.1, describing how attackers can bypass per‑call user approval. No exploit, patch, or active use is detailed.

Infoflowcloud@infoflowcloudDisclosure

The tweet announces CVE‑2026‑45244, outlining a missing‑authorization flaw in prior releases that allows automated browser actions without user approval, but offers no evidence of active exploitation or mitigation.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The excerpt announces a new missing‑authorization flaw in the Summarize component (prior to version 0.15.1) that permits unauthorized extension automation, without providing exploitation details or mitigation steps.