Is CVE-2026-45244 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45244 being exploited in the wild.

How severe is CVE-2026-45244?

Medium severity, with a CVSS score of 5.4, published 18 May 2026.

Which products and versions are affected?

@steipete/summarize (npm) < 0.15.0, SEMVER:introduced=0,fixed=0.15.0; Steipete Summarize < 0.15.0, prior to 0.15.1.

Is there a fix for CVE-2026-45244?

Yes. @steipete/summarize (npm): upgrade to 0.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45244 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-45244?

Check whether you run @steipete/summarize (npm) or Steipete Summarize at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45244: steipete Summarize missing authorization in browser automation

Q: Is there a fix for CVE-2026-45244?

Yes. @steipete/summarize (npm): upgrade to 0.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-45244 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-45244?

Check whether you run @steipete/summarize (npm) or Steipete Summarize at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45244 · Severity: medium · CVSS 5.4 · Published 2026-05-18

Summarize is a browser extension used for summarizing web content and automating browser tasks. A security flaw allows malicious websites to trick the extension into performing automated actions—such as navigating the browser or using debugging tools—without the user's explicit permission. This could lead to unauthorized browser activity or the exposure of sensitive information if a user interacts with a compromised webpage while the extension's automation features are active.

Technologies: @steipete/summarize (npm), Steipete Summarize. Vendors: npm, Steipete.

Quick answers

Is CVE-2026-45244 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45244 being exploited in the wild.
How severe is CVE-2026-45244?: Medium severity, with a CVSS score of 5.4, published 18 May 2026.
Which products and versions are affected?: @steipete/summarize (npm) < 0.15.0, SEMVER:introduced=0,fixed=0.15.0; Steipete Summarize < 0.15.0, prior to 0.15.1.
Is there a fix for CVE-2026-45244?: Yes. @steipete/summarize (npm): upgrade to 0.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45244 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-45244?: Check whether you run @steipete/summarize (npm) or Steipete Summarize at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@steipete/summarize (npm): upgrade to 0.15.0 or later
```
npm install @steipete/summarize@0.15.0
```

Technical details

A missing authorization vulnerability (CWE-862) exists in the Summarize Chrome extension's chat agent loop. When the automation feature is enabled, the extension fails to require per-call user confirmation before executing model-requested automation tools. An attacker can use prompt injection or malicious page content to influence the agent into invoking privileged tools, such as navigation or debugger-backed actions. This occurs because the 'runChatAgentLoop' function directly calls 'executeToolCall' without a confirmation gate. The vulnerability is remediated in version 0.15.0 by implementing a 'confirmToolCall' hook that triggers a browser confirmation prompt before any automation action is executed.

Affected products

steipete Summarize (Chrome Extension) < 0.15.0

Identifiers

CVE-2026-45244
GHSA-67gq-6q8c-qqh6

Timeline

2026-05-12: other: Fix proposed in pull request
2026-05-13: patched: Fix merged into main branch
2026-05-18: disclosed: NVD publication date
2026-05-18: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.