Prisma Browser EUVD-2026-42691

Exploitation requires all of the following to be true simultaneously: (1) the target system is running macOS - the vulnerability does not affect any other platform; (2) the attacker holds a locally authenticated administrator account on that macOS system (PR:H); (3) the attacker has access to the macOS local filesystem; and (4) some form of active user interaction occurs (UI:A per CVSS 4.0), meaning the exploit cannot be triggered purely programmatically without some participatory action. Attack prerequisites beyond attacker control are present (AT:P), suggesting an environmental or timing condition must align. What limits exploitation: the attacker must already be an authenticated local administrator, precluding remote unauthenticated exploitation entirely; the macOS-only scope excludes all other Prisma Browser deployments; and the required user interaction further narrows automated or mass exploitation scenarios.

The CVSS 4.0 base score of 2.0 is notably low, driven by the convergence of multiple restrictive metrics: AV:L (requires local system access), PR:H (requires locally authenticated administrator), UI:A (requires active user interaction), and AT:P (specific attack prerequisites beyond attacker control). Despite VC:H/VI:H/VA:H indicating full compromise of confidentiality, integrity, and availability of the vulnerable system, the stacked prerequisites dramatically reduce exploitability. The E:U modifier (exploitation unreported) further signals no known exploit code exists. There is no CISA KEV listing and no POC is identified, confirming this as a theoretical escalation path rather than an active threat. SSVC signals point toward a 'Track' disposition - real impact potential exists if an attacker already holds local admin access, but the scenario requires both physical or authenticated local access AND an administrative account, making this a post-compromise lateral movement aid rather than an initial access vector. The SC:N/SI:N/SA:N metrics confirm no lateral impact to other networked systems, bounding blast radius to the local macOS host.

A malicious insider or attacker who has already compromised a macOS endpoint and obtained local administrator credentials interacts with Prisma Browser in a specific manner - potentially abusing a privileged helper tool or IPC interface - causing the application to execute an action as root. This root-level execution could be leveraged to modify system files, install persistent malware, or extract credentials from protected macOS keychain storage. No public exploit code is known at time of analysis; exploitation requires both local admin access and user interaction, making opportunistic attacks unlikely.