Which versions of Chrome are affected by CVE-2026-1078?

CVE-2026-1078 affects Pega Robotic Automation users via a browser extension vulnerability that enables arbitrary file writes when users visit malicious websites during automation tasks.

How to fix or mitigate CVE-2026-1078?

Within 24 hours: Inventory all Pega Robotic Automation installations (versions 22.1 and R25) and identify systems where Robot Runtime operates with browser extensions enabled. Restrict affected users' ability to browse untrusted websites during active automation sessions. Within 7 days: Document current browser extension versions and disable the Pega Browser Extension on non-critical systems pending vendor patch availability; communicate patch timeline expectations to Pega support. Within 30 days: Establish a vendor patch monitoring process and prepare a deployment plan once Pega releases a fixed version; consider alternative RPA execution environments or sandboxed browser instances as interim alternatives.

Chrome CVE-2026-1078

Q: What is the CVSS score of CVE-2026-1078?

CVE-2026-1078 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19638 HIGH

Improper Access Control (CWE-284)

2026-04-07 Pega

Google Microsoft Authentication Bypass Chrome

7.2

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 07, 2026 - 15:30 euvd

EUVD-2026-19638

Analysis Generated

Apr 07, 2026 - 15:30 vuln.today

CVE Published

Apr 07, 2026 - 15:04 nvd

HIGH 7.2

DescriptionCVE.org

An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robotic Automation version 22.1 or R25 users who are running automations that work with Google Chrome or Microsoft Edge. A bad actor could create a website that includes malicious code. The vulnerability could occur if a Robot Runtime user navigates to the malicious website.

AnalysisAI

Arbitrary file write in Pega Browser Extension allows remote attackers to compromise system integrity when Robot Runtime users visit malicious websites while running automations in Chrome or Edge. Affects Pega Robotic Automation versions 22.1 and R25. Attack requires user interaction (navigating to attacker-controlled site) but no authentication. No public exploit identified at time of analysis, though attack complexity is low once user visits malicious site.

Technical ContextAI

This vulnerability stems from CWE-284 (Improper Access Control) in the Pega Browser Extension component that bridges Pega Robot Studio automations with web browsers. The PBE runs with elevated privileges to enable robotic process automation tasks in Chrome and Edge browsers. The improper access control allows malicious websites to exploit the extension's file system interaction capabilities, writing arbitrary files to locations that should be protected. This represents a classic browser extension security failure where insufficient origin validation or sandboxing permits hostile web content to abuse extension APIs. The CVSS 4.0 vector shows high integrity and availability impact on the vulnerable system (VI:H, VA:H) and subsequent system impacts (SI:H, SA:H), indicating potential for system-wide compromise beyond just the browser context.

RemediationAI

Organizations should immediately consult the Pega Security Advisory A26 available at https://support.pega.com/support-doc/pega-security-advisory-a26-vulnerability-remediation-note for vendor-released patches and upgrade guidance. Patch available per vendor advisory, though exact remediated version numbers are not specified in available data. As an interim mitigation, restrict Robot Runtime user access to only trusted, verified websites during automation execution through browser policy controls, network filtering, or allowlist-based access restrictions. Implement additional monitoring for unexpected file system modifications on systems running Pega robotic automations. Review and limit file system permissions available to the Pega Browser Extension and Robot Runtime processes using principle of least privilege. Consider isolating RPA environments on dedicated systems or virtual machines with restricted network access until patches are deployed.