Which versions of Idira Identity Browser Extension are affected by CVE-2026-45173?

CyberArk's Idira Identity Browser Extension (versions prior to 26.8.1) contains a validation vulnerability that enables attackers to intercept authenticated user sessions and access the…. A patch is available.

How to fix or mitigate CVE-2026-45173?

Within 24 hours: Alert all Idira extension users of the vulnerability; document current deployment scope and user count. Within 7 days: Contact CyberArk support for patch ETA and interim guidance; evaluate whether disabling the extension is operationally feasible. Within 30 days: Deploy compensating controls; test patched versions in non-production once available; plan rollout timeline for patched extension.

Idira Identity Browser Extension CVE-2026-45173

Q: What is the CVSS score of CVE-2026-45173?

CVE-2026-45173 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber. EPSS exploitation probability: 0.1%.

EUVD-2026-36363 HIGH

Origin Validation Error (CWE-346)

2026-06-11 palo_alto

GHSA-mmjg-x39c-438q

Authentication Bypass Google Mozilla Identity Browser Extensions Cyberark Software A Palo Alto Networks Company

8.4

CVSS 4.0 · Vendor: palo_alto

Severity by source

Vendor (palo_alto) PRIMARY

8.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber

vuln.today AI

8.2 HIGH

Remote crafted page (AV:N/AC:L), no attacker auth (PR:N), victim must visit page (UI:R); origin bypass crosses extension trust boundary into identity backend so S:C with high confidentiality and limited integrity impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (palo_alto).

CVSS VectorVendor: palo_alto

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 12, 2026 - 02:01 EUVD

Analysis Generated

Jun 11, 2026 - 22:30 vuln.today

CVE Published

Jun 11, 2026 - 21:33 cve.org

HIGH 8.4

DescriptionCVE.org

Idira Identity Browser Extension (Chrome, Firefox, and Edge builds) versions prior to 26.8.1 exhibit an origin validation flaw within its internal web-page verification routines. If an authenticated user navigates to a specially crafted webpage, this interaction could potentially allow a remote attacker to trigger unauthorized application interaction or execution parameters within the context of that authenticated browser session. CyberArk Security Bulletin: CA26-21

AnalysisAI

Origin validation failure in CyberArk's Idira Identity Browser Extension for Chrome, Firefox, and Edge (versions prior to 26.8.1) allows a remote attacker to abuse an authenticated user's browser session by luring them to a malicious page. Per CyberArk bulletin CA26-21, the extension's internal web-page verification routine fails to correctly enforce origin checks (CWE-346), enabling unauthorized application interaction in the victim's identity context. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 8.4 reflects high confidentiality impact and subsequent-system impact via the identity SaaS the extension brokers.

Technical ContextAI

The affected component is a browser extension that bridges CyberArk Identity (formerly Idaptive) SaaS authentication into Chrome, Firefox, and Edge - typically for SSO, secrets retrieval, or workforce identity flows. CWE-346 (Origin Validation Error) here means the extension's content-script or message-handler routines accept events, postMessage payloads, or DOM signals from an unintended origin instead of strictly verifying the sender's window.origin against an allowlist. Because browser extensions inherit elevated privileges (cross-origin XHR, storage, cookie access) and the Idira extension specifically holds tokens or session material for the identity tenant, an origin-confused message can cause the extension to act on behalf of the victim against the legitimate identity backend. The CPE confirms the affected vendor as CyberArk Software (a Palo Alto Networks company), product 'identity_browser_extensions', all versions until the 26.8.1 fix.

RemediationAI

Vendor-released patch: upgrade the Idira Identity Browser Extension to version 26.8.1 or later in Chrome, Firefox, and Edge - refer to CyberArk Security Bulletin CA26-21 (accessible via https://docs.cyberark.com/find-identity-administration-docs/latest/en/content/getstarted/identity-new-doc-location.htm) for the per-browser store links. Where managed deployment is in use, force-update the extension via Chrome Enterprise/Edge admin policies (ExtensionInstallForcelist with minimum_version_required) and Firefox Enterprise policies so that users cannot stay on a vulnerable build; this has the side effect of restarting the extension and may briefly interrupt active SSO sessions. As an interim compensating control before users update, restrict identity-extension usage to managed browsers and consider disabling the extension via policy for high-risk groups (the trade-off is loss of SSO/secrets autofill and a likely password-prompt surge), and remind users not to follow untrusted links while logged into the CyberArk Identity tenant. Network egress filtering will not mitigate this because the exploit traffic is the user's own browser navigating to attacker-chosen origins.