Disclosure summary
Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows attackers to execute browser automation actions without per-call user approval when the extension automation feature is enabled. Attackers can influence the agent through malicious page or summary content to invoke enabled extension automation tools such as navigation or debugger-backed actions, bypassing the final user approval step when a user interacts with attacker-controlled content.
Source-reported weakness categories
CWE-862
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2026-45244
Open original source · Updated Oct 08, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
| Vendor | Product / association | Version / bounds |
|---|---|---|
| steipete | summarize | * {"versionEndExcluding":"0.15.1"} |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Patch
- github.com — Exploit, Issue Tracking, Patch
- github.com — Release Notes
- www.vulncheck.com — Third Party Advisory
PUBLISHED 2026-05-18T16:16:38-04:00
MODIFIED 2026-10-08T12:17:16-04:00
INGESTED 2026-10-10T20:50:35-04:00