Idira Identity Browser Extension EUVD-2026-36363

Victim must have the Idira Identity Browser Extension installed in Chrome, Firefox, or Edge at a build below 26.8.1 AND must be in an active authenticated session with their CyberArk Identity tenant at the time of the attack. The attacker does not need credentials, network position, or prior access to the target environment, but the victim must perform a passive interaction - navigating to or rendering a specially crafted webpage (UI:P) - which is the only meaningful limiting factor; this is satisfied by typical phishing or malvertising. Exploitation does not depend on a non-default configuration of the extension; any installation of an unpatched version exposes the user. The impact is scoped to what the extension can do on behalf of the user against the connected identity backend, not arbitrary code execution on the host.

Signals point to a real, prioritized issue but not an immediate emergency. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N with subsequent-system SC:H/SI:H is consistent with a browser-extension origin flaw: passive user interaction (visiting a crafted page) is the only gate, and the highest impact lands on the connected identity system rather than the local browser, which the 4.0 model captures via the subsequent-system metrics. There is no CISA KEV listing and no public exploit identified at time of analysis, and EPSS data was not provided, so widespread opportunistic exploitation is unlikely in the very short term. Two caveats: the description's phrase 'authenticated user navigates to a specially crafted webpage' refers to the victim being authenticated to the identity service, not authentication against the extension itself - so PR:N is correct and this should not be downgraded as 'requires auth.' Confidence in affected-version data is high (vendor bulletin CA26-21), but the public CyberArk reference URL provided is a generic documentation landing page rather than the bulletin itself, so verifying patch notes directly with CyberArk support is recommended.

An attacker hosts a crafted page (or injects content into a watering-hole site) that issues postMessage or DOM events designed to bypass the extension's origin check. A workforce user already signed into the CyberArk Identity tenant visits the page during normal browsing; the extension processes the attacker-controlled message as if it came from the legitimate Identity origin, granting the attacker the ability to trigger unauthorized identity-application interactions or read sensitive parameters from the authenticated session. No public exploit identified at time of analysis, but the prerequisites (one click on a link) are low and well-aligned with phishing-driven delivery.