Summarize CVE-2026-45245

The victim must have the Summarize browser extension (any version prior to 0.15.1) installed and active, with the hover summary feature enabled and the local daemon running with stored authentication tokens. The victim must visit or render attacker-controlled web content (e.g., a malicious site, a compromised page, or a malicious ad/iframe) capable of executing JavaScript to dispatch synthetic mouseover events; no genuine mouse movement is required because the flaw is the absence of an isTrusted check, but the page must successfully load in a context where the extension's content script is injected. Exploitation is limited by what internal endpoints the daemon's stored token authorizes and what the daemon's allowed URL schemes permit, and by the user having browsed to attacker-controlled content in the first place.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N yields a 7.4 (High) score driven by network reach, low complexity, no authentication required, changed scope (the daemon acts on behalf of another security authority), and high confidentiality impact against the internal network. UI:R is justified because the victim must browse to an attacker-controlled page and have hover/mouse interaction occur, though synthetic event dispatch reduces this to near-passive interaction. No EPSS score, KEV listing, or public POC was provided, so the issue should be treated as 'no public exploit identified at time of analysis' rather than actively exploited; however, the SSRF-to-internal-network primitive against authenticated daemons is a well-understood, easily weaponizable class. The vendor patch in v0.15.2 and a VulnCheck advisory confirm the issue is real and validated by a third party, making prompt extension upgrade the right priority despite the absence of exploitation telemetry.

An attacker hosts a webpage containing an invisible anchor tag pointing to http://127.0.0.1:8080/admin or an internal service URL, then uses JavaScript to dispatch a synthetic MouseEvent('mouseover') on that anchor as soon as the victim visits the page. The Summarize extension's hover-preview handler treats the synthetic event as legitimate user interaction and instructs the local daemon - using stored authentication tokens - to fetch the internal URL, returning its contents (or side-effects) to the attacker's reachable summary context. No public POC is referenced, but the technique is mechanically trivial given any JavaScript execution on the victim's page.