Missing Authorization in Summarize Browser Extension by Steipete

CVE-2026-45243

What is CVE-2026-45243?

A missing authorization vulnerability has been identified in the Summarize browser extension, affecting versions prior to 0.15.1. This flaw allows attackers to exploit the content script window.postMessage bridge, enabling unauthorized operations on automation artifacts. By simulating runtime messages with spoofed sender identifiers, malicious actors can list, read, create, overwrite, or delete automation artifacts scoped to the affected tab, circumventing necessary authorization checks. This exposes users to potential misuse of their automation functionalities.

References