Pega Browser Extension Pbe CVE-2026-1079

The CVSS 6.0 score with AV:N/AC:L/PR:N/UI:P indicates network-accessible, low-complexity attack requiring user interaction but no authentication. The CVSS vector shows no confidentiality or integrity impact (VC:N/VI:N) but high availability impact (VA:H) with limited scope (SA:L), suggesting the vulnerability causes temporary service disruption or denial rather than data breach. The CVSS 4.0 vector includes AT:P (attack trigger probability), which moderates real-world exploitation likelihood. No KEV status, EPSS score, or public exploit code are available in the source intelligence, meaning this is a lower-priority vulnerability compared to confirmed actively exploited flaws, though organizations using Pega Robotic Automation should still address it within standard patching cycles. The requirement for user navigation to a malicious website further limits automated attack surface.

An attacker creates a malicious website containing JavaScript that exploits the native messaging host interface of Pega Browser Extension. When a user with PBE installed navigates to this website (either via social engineering or accidental discovery), the malicious script communicates with the PBE native host and triggers an unexpected message box, potentially interrupting the user's workflow or causing the browser extension to malfunction. No public proof-of-concept or active exploitation in the wild has been reported at the time of analysis.