Summarize EUVD-2026-30794

The Summarize browser extension must be installed and active in the victim's Chrome or Firefox browser at the time of the attack. Exploitation requires the victim to passively visit an attacker-controlled web page (UI:P per CVSS 4.0); no clicks, form submissions, or further interaction are needed beyond navigation. The attack is unauthenticated (PR:N) and works against default extension configurations - no non-default settings are required. Impact is strictly bounded to automation artifacts scoped to the active browser tab managed by the extension; the host filesystem, operating system, other browser tabs, and credentials stored outside the extension are not reachable via this vulnerability. Exploitation is prevented if the extension is disabled, uninstalled, or if the browser blocks the affected tab from receiving cross-origin postMessages through policy.

The CVSS 4.0 score of 5.3 (Medium) reflects a network-accessible (AV:N), low-complexity (AC:L), no-prerequisites (AT:N, PR:N) attack requiring only passive user interaction (UI:P - visiting a malicious page). The vulnerable system itself shows no direct confidentiality, integrity, or availability impact (VC:N/VI:N/VA:N), while the subsequent system - tab-scoped artifact storage - sustains low confidentiality and integrity impact (SC:L/SI:L). The score accurately characterizes the bounded blast radius: an attacker can only reach extension-managed artifacts for the affected tab, not the host OS, filesystem, or other browser contexts. No EPSS data was supplied, and the absence of a KEV listing combined with no identified POC means exploitation risk is inferred from the vulnerability class and CVSS vector rather than observed threat activity. The real-world exploitation bar is low (any web page can send postMessages with arbitrary content), but the realistic damage is constrained to the extension's own data plane, making this a genuine medium-severity authorization bypass rather than a critical remote code execution.

A user with a vulnerable version of the Summarize extension installed navigates to an attacker-controlled web page. Without any further user action, the page's JavaScript sends window.postMessage calls to the extension content script using spoofed sender identifiers. The content script bridge, lacking origin or sender validation, processes these as trusted internal messages. The attacker's script then enumerates automation artifacts stored for the tab and either exfiltrates their content or overwrites them with attacker-controlled data, all silently within the browser session.