Prisma Browser EUVD-2026-30087

Exploitation requires a locally authenticated non-admin user session on an endpoint running Palo Alto Networks Prisma® Browser in a version prior to 146.16.6.165 - confirming that remote exploitation is not possible (AV:L). The attacker must have low-level privileges (PR:L) but specifically must not be an administrator, as the bypass targets policy controls applied to non-admin users. Critically, the race condition (AT:P in CVSS 4.0) means exploitation is timing-dependent: the attacker must successfully hit a concurrent execution window during policy evaluation, which is neither automatable nor reliably reproducible at scale per SSVC and the AU:N supplemental metric. What limits exploitation: local-only access vector eliminates remote attack surface entirely; race condition timing dependency makes scripted or mass exploitation impractical; requires a non-admin authenticated session, ruling out unauthenticated external attackers; and SSVC confirms non-automatable exploitation with only partial technical impact.

The CVSS 4.0 base score of 5.8 (Medium) reflects a local-only attack vector with low privilege requirements and no user interaction, but tempered by the presence of attack timing requirements (AT:P) and a constrained impact scope - high confidentiality impact to the vulnerable system only (VC:H), low integrity impact (VI:L), and no availability or cross-system scope impact. EPSS at 0.01% and the 3rd percentile strongly suggests this vulnerability is not being actively targeted in the wild, consistent with the SSVC exploitation status of none and the non-KEV classification. The CVSS 4.0 supplemental metadata adds nuance: urgency is rated Amber, recovery requires user action (R:U), and response effort is rated Difficult (V:D), suggesting that while exploitation risk is currently low, the remediation pathway has operational friction. The primary real-world risk is an insider threat or compromised non-admin account bypassing DLP and access controls - relevant in regulated industries where Prisma Browser is deployed precisely for its policy enforcement value. This is not a high-priority internet-facing exposure, but its bypass of security controls makes it architecturally significant within its deployment context.

A locally authenticated non-admin employee on a managed endpoint running Prisma Browser prior to 146.16.6.165 deliberately triggers concurrent browser operations - such as simultaneously initiating a file upload and a navigation event - to exploit the policy enforcement race condition, causing the access control check to complete in a state that incorrectly permits the action. The attacker successfully exfiltrates data or accesses content that the configured data control policies were designed to block. No public exploit code has been identified at time of analysis, and reliable exploitation requires precise timing coordination, limiting automated or opportunistic attacks.