Is CVE-2026-45243 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45243 being exploited in the wild.

How severe is CVE-2026-45243?

Medium severity, with a CVSS score of 6.1, published 18 May 2026.

Which products and versions are affected?

@steipete/summarize (npm) < 0.15.0, SEMVER:introduced=0,fixed=0.15.0; Steipete Summarize < 0.15.0, prior to 0.15.0, prior to 0.15.1.

Is there a fix for CVE-2026-45243?

Yes. @steipete/summarize (npm): upgrade to 0.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45243 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-45243?

Check whether you run @steipete/summarize (npm) or Steipete Summarize at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45243: steipete Summarize missing authorization in content script bridge

Q: Is there a fix for CVE-2026-45243?

Yes. @steipete/summarize (npm): upgrade to 0.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-45243 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-45243?

Check whether you run @steipete/summarize (npm) or Steipete Summarize at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45243 · Severity: medium · CVSS 6.1 · Published 2026-05-18

Summarize is a Chrome extension that summarizes web content and manages automation artifacts. A missing authorization vulnerability in the extension's content script allowed malicious webpages to read, create, or delete automation artifacts stored by the extension without proper permission checks. An attacker could craft a malicious webpage to intercept and manipulate automation data belonging to users visiting that page.

Technologies: @steipete/summarize (npm), Steipete Summarize. Vendors: npm, Steipete.

Quick answers

Is CVE-2026-45243 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45243 being exploited in the wild.
How severe is CVE-2026-45243?: Medium severity, with a CVSS score of 6.1, published 18 May 2026.
Which products and versions are affected?: @steipete/summarize (npm) < 0.15.0, SEMVER:introduced=0,fixed=0.15.0; Steipete Summarize < 0.15.0, prior to 0.15.0, prior to 0.15.1.
Is there a fix for CVE-2026-45243?: Yes. @steipete/summarize (npm): upgrade to 0.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45243 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-45243?: Check whether you run @steipete/summarize (npm) or Steipete Summarize at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@steipete/summarize (npm): upgrade to 0.15.0 or later
```
npm install @steipete/summarize@0.15.0
```

Technical details

The vulnerability is a missing authorization check (CWE-862) in the content script's window.postMessage bridge used for automation artifact management. The vulnerable code in the all-pages automation content script accepted message events from untrusted page scripts and forwarded them directly to the background worker as automation:artifacts messages without verifying that the request originated from trusted extension code. An attacker could craft JavaScript on a malicious webpage to send forged postMessage events with action and payload parameters to list, read, create, overwrite, or delete tab-scoped automation artifacts. The only scope check performed was the sender's tab ID, which is controlled by the attacker's page context. The fix (released in v0.15.0) removes the page-visible postMessage bridge entirely, moves artifact operations to the extension's user-script messaging channel (chrome.runtime.sendMessage), and requires an explicit extension-origin arm/disarm handshake before artifact operations are accepted by the background worker.

Affected products

steipete Summarize prior to 0.15.0

Identifiers

CVE-2026-45243
GHSA-5624-2pmv-jx46

Timeline

2026-05-18: disclosed: Vulnerability published
2026-05-15: patched: Fix released in version 0.15.0
2026-05-29: advisory: GitHub security advisory reviewed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.