2.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45244

CVE-2026-45244: Summarize < 0.15.1 Unapproved Browser Automation Execution

Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows attackers to execute browser automation actions without per-call user approval when the extension automation feature is enabled. Attackers can influence the agent through malicious page or summary content to invoke enabled extension automation tools such as navigation or debugger-backed actions, bypassing the final user approval step when a user interacts with attacker-controlled content.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45244

CVE-2026-45244:

2.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@steipete/summarize	npm	< 0.15.0	0.15.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability in Summarize prior to version 0.15.0 allowed an attacker to execute browser automation actions without explicit user consent. This was due to a missing authorization check when the AI agent decided to use a "tool call," such as navigating to a new page or interacting with the browser's debugger.

The analysis of the security patch in commit e64fe3ecd1bb4fdc181dcfa88c96b9e1914ced0e reveals that the core issue resided in the runChatAgentLoop function. This function processes instructions from the AI model and, in vulnerable versions, would directly execute any requested tool calls. An attacker could influence the agent through malicious page content, causing it to generate a harmful tool call that would be executed without any user prompt.

The fix involves two key functions:

runChatAgentLoop: This function was modified to accept a new confirmToolCall callback. Before executing a tool, it now invokes this callback to get user approval. If approval is denied, the tool call is cancelled.
runAgentLoop: This function, which initiates the agent process, was updated to create and supply the confirmAutomationToolCall function to runChatAgentLoop. This new function is responsible for showing a window.confirm() dialog to the user, clearly describing the action the agent wants to take and asking for explicit approval.

During an exploit, the runAgentLoop function would start the process, and the runChatAgentLoop function would be on the call stack as it processes the malicious tool call without prompting the user. Therefore, both functions are critical runtime indicators of the vulnerability.

Vulnerable functions

runChatAgentLoop

apps/chrome-extension/src/entrypoints/sidepanel/chat-agent-loop.ts

This function is responsible for processing and executing tool calls from the AI agent. Prior to the patch, it would iterate through and execute all tool calls without user confirmation. An attacker could craft malicious content that would cause the agent to generate a dangerous tool call (e.g., for navigation or debugger access), which this function would then execute without approval. The patch introduces a call to `confirmToolCall` to get user consent before execution.

runAgentLoop

apps/chrome-extension/src/entrypoints/sidepanel/main.ts

This function initializes and starts the chat agent loop by calling `runChatAgentLoop`. In the vulnerable version, it called `runChatAgentLoop` without providing a mechanism for user confirmation of tool calls. The patch modifies this function to pass `confirmAutomationToolCall` as the `confirmToolCall` parameter, effectively enabling the security check. The vulnerability exists because this function failed to enforce the necessary authorization step.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.