EUVD-2026-30796
GHSA-67gq-6q8c-qqh6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUser enables extension automation feature
-
DeliveryAttacker crafts malicious page with injected prompt instructions
-
ExploitUser invokes Summarize on attacker-controlled content
-
ExecutionAgent processes unescaped content delimiters as trusted instructions
-
PersistPer-call approval step bypassed
-
ImpactUnauthorized browser automation actions execute
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The extension automation feature in Summarize must be explicitly enabled by the user - this is the single most important limiting condition, as the vulnerable code path is entirely gated by this non-default feature toggle. The user must interact with attacker-controlled content (UI:R per CVSS vector), meaning the user must actively trigger Summarize on a malicious page or summary. No attacker-side authentication or privileges are required (PR:N). Exploitation is scoped to browser-level actions within the extension's automation toolkit (navigation, debugger-backed actions) and cannot escalate beyond the browser sandbox (S:U). Versions at or above 0.15.2 contain the delimiter-escaping fix and are not exploitable via this vector. |
| Impact | CVSS scores this at 5.4 (Medium) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. Network delivery with low complexity and no required attacker privileges increases theoretical reachability, but the mandatory user interaction (UI:R) and unchanged scope (S:U) meaningfully constrain real-world impact. The confidentiality and integrity impacts are both rated Low, consistent with browser-bounded automation actions rather than OS-level compromise. No EPSS data was provided in the input, and there is no CISA KEV listing - active exploitation is unconfirmed. The non-default requirement of the extension automation feature being explicitly enabled further limits exposure to a subset of the installed userbase. The CVSS vector is consistent with the vulnerability description; no conflicting signals are present. Overall, this is a real but bounded risk: moderate severity for users with automation enabled, low priority for users who have never activated that feature. |
| Exploit ScenarioDerived | A user with the Summarize extension installed and the extension automation feature enabled visits a web page crafted by an attacker to embed prompt-injection instructions within visible or hidden page content. When the user invokes Summarize on that page, the AI agent processes the malicious content, interprets the injected instructions as legitimate automation requests, and executes browser automation actions - such as navigating to a new URL or invoking debugger-accessible operations - without surfacing the per-call approval dialog that would otherwise require the user's explicit consent. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 18, 2026
Missing authorization in the Summarize browser extension (versions prior to 0.15.1/0.15.2, CPE: cpe:2.3:a:steipete:summarize) allows remote unauthenticated attackers to execute browser automation actions - including navigation and debugger-backed operations - without triggering per-call user approval. Exploitation requires the extension automation feature to be enabled and the user to interact with attacker-controlled content (UI:R per CVSS), making this a prompt-injection-driven authorization bypass rather than a standalone remote attack. No public exploit has been identified at time of analysis, and the vendor released a patch in v0.15.2 as reported by VulnCheck.
RemediationAI
Upgrade to Summarize v0.15.2 or later, which includes the fix for untrusted prompt context and content delimiter escaping introduced in commit e64fe3ecd1bb4fdc181dcfa88c96b9e1914ced0e via PR https://github.com/steipete/summarize/pull/219. The patched npm packages @steipete/summarize@0.15.2 and @steipete/summarize-core@0.15.2 are available at their respective npm registry URLs as of 2026-05-17. The release is available at https://github.com/steipete/summarize/releases/tag/v0.15.2 for both Chrome and Firefox extension distributions. As a compensating control prior to upgrading, explicitly disabling the extension automation feature eliminates the attack surface entirely, since this feature must be enabled for exploitation - the trade-off is loss of all browser automation functionality including navigation and debugger-backed actions. No other workarounds are identified from available data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in npm, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Summarize is an AI-powered browser extension and CLI tool (CPE: cpe:2.3:a:steipete:summarize) that processes web page and document content through an AI agent and exposes optional extension automation capabilities including browser navigation and Chrome DevTools Protocol (debugger-backed) actions. The root cause is CWE-862 (Missing Authorization): when the extension automation feature is enabled, the system feeds page or summary content into the agent without escaping content delimiters, creating a prompt injection pathway. Attacker-controlled content can embed instructions that cause the agent to invoke automation tools, bypassing the per-call approval gate that is supposed to require explicit user consent before each automation action executes. The v0.15.2 fix explicitly addresses this by escaping untrusted prompt context and content delimiters (per release notes: 'Core prompts: escape untrusted prompt context/content delimiters'), confirming that insufficient input sanitization upstream of the authorization check was the mechanism of bypass.
Know when Summarize gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows attackers to execute browser automation actions without per-call user approval when the extension automation feature is enabled. Attackers can influence the agent through malicious page or summary content to invoke enabled extension automation tools such as navigation or debugger-backed actions, bypassing the final user approval step when a user interacts with attacker-controlled content.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Path traversal in steipete/summarize prior to 0.15.1 lets authenticated callers of the /v1/summarize daemon endpoint wri
Summarize versions through 0.14.1 create daemon configuration files with world-readable permissions, allowing local atta
Insecure file permission assignment in the @steipete/summarize CLI tool exposes configuration files containing API keys
Server-side request forgery in steipete/Summarize before v0.17.0 enables an attacker who controls a podcast RSS feed to
Disk exhaustion in Summarize CLI (all versions before 0.17.0) allows remote attackers who control a podcast feed or medi
Missing authorization in the Summarize browser extension's content script window.postMessage bridge permits any maliciou
Server-side request forgery in the Summarize browser extension prior to version 0.15.2 allows malicious web pages to coe
Exploit-DB