Arbitrary File-Write Vulnerability in Pega Browser Extension for Pega Robotic Automation

CVE-2026-1078

What is CVE-2026-1078?

An arbitrary file-write vulnerability exists in the Pega Browser Extension, which affects users of Pega Robotic Automation versions 22.1 and R25. This issue arises when users running automation workflows in Google Chrome or Microsoft Edge navigate to a malicious website specifically designed to exploit this vulnerability. If successfully executed, a bad actor can potentially write files to arbitrary locations on the affected system, leading to unauthorized access and manipulation of files. Organizations using these versions must apply security patches and follow recommended guidance to mitigate this risk. For more information, refer to the official security advisory.

References