Executive brief
Summarize is a Chrome extension that summarizes web content and manages automation artifacts. A missing authorization vulnerability in the extension's content script allowed malicious webpages to read, create, or delete automation artifacts stored by the extension without proper permission checks. An attacker could craft a malicious webpage to intercept and manipulate automation data belonging to users visiting that page.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the content script's window.postMessage bridge used for automation artifact management. The vulnerable code in the all-pages automation content script accepted message events from untrusted page scripts and forwarded them directly to the background worker as automation:artifacts messages without verifying that the request originated from trusted extension code. An attacker could craft JavaScript on a malicious webpage to send forged postMessage events with action and payload parameters to list, read, create, overwrite, or delete tab-scoped automation artifacts. The only scope check performed was the sender's tab ID, which is controlled by the attacker's page context. The fix (released in v0.15.0) removes the page-visible postMessage bridge entirely, moves artifact operations to the extension's user-script messaging channel (chrome.runtime.sendMessage), and requires an explicit extension-origin arm/disarm handshake before artifact operations are accepted by the background worker.
Affected products
- steipete Summarize prior to 0.15.0
Timeline
- 2026-05-18: disclosed: Vulnerability published
- 2026-05-15: patched: Fix released in version 0.15.0
- 2026-05-29: advisory: GitHub security advisory reviewed
References
- https://github.com/steipete/summarize/pull/222
- https://github.com/steipete/summarize/commit/357544063af535bd574752622f9eb94be33ee5fd
- https://github.com/steipete/summarize
- https://github.com/steipete/summarize/releases/tag/v0.15.1
- https://github.com/steipete/summarize/releases/tag/v0.15.2
- https://www.vulncheck.com/advisories/summarize-browser-extension-missing-authorization-via-content-script