# CVE-2026-45244: steipete Summarize missing authorization in browser automation

Source: https://junglewise.ai/threats/cve-2026-45244-steipete-summarize-missing-authorization-in-browser-automation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-18. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-45244 · Severity: medium · CVSS 5.4 · Published 2026-05-18

Summarize is a browser extension used for summarizing web content and automating browser tasks. A security flaw allows malicious websites to trick the extension into performing automated actions—such as navigating the browser or using debugging tools—without the user's explicit permission. This could lead to unauthorized browser activity or the exposure of sensitive information if a user interacts with a compromised webpage while the extension's automation features are active.

Technologies: [@steipete/summarize (npm)](https://junglewise.ai/threats/technologies/steipete-summarize), [Steipete Summarize](https://junglewise.ai/threats/technologies/summarize). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Steipete](https://junglewise.ai/threats/vendors/steipete).

## Quick answers

**Is CVE-2026-45244 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45244 being exploited in the wild.

**How severe is CVE-2026-45244?** Medium severity, with a CVSS score of 5.4, published 18 May 2026.

**Which products and versions are affected?** @steipete/summarize (npm) < 0.15.0, SEMVER:introduced=0,fixed=0.15.0; Steipete Summarize < 0.15.0, prior to 0.15.1.

**Is there a fix for CVE-2026-45244?** Yes. @steipete/summarize (npm): upgrade to 0.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45244 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-45244?** Check whether you run @steipete/summarize (npm) or Steipete Summarize at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @steipete/summarize (npm): upgrade to 0.15.0 or later

  ```sh
  npm install @steipete/summarize@0.15.0
  ```


## Technical details

A missing authorization vulnerability (CWE-862) exists in the Summarize Chrome extension's chat agent loop. When the automation feature is enabled, the extension fails to require per-call user confirmation before executing model-requested automation tools. An attacker can use prompt injection or malicious page content to influence the agent into invoking privileged tools, such as navigation or debugger-backed actions. This occurs because the 'runChatAgentLoop' function directly calls 'executeToolCall' without a confirmation gate. The vulnerability is remediated in version 0.15.0 by implementing a 'confirmToolCall' hook that triggers a browser confirmation prompt before any automation action is executed.

## Affected products

- steipete Summarize (Chrome Extension) < 0.15.0

## Identifiers

- CVE-2026-45244
- GHSA-67gq-6q8c-qqh6

## Timeline

- 2026-05-12: other: Fix proposed in pull request
- 2026-05-13: patched: Fix merged into main branch
- 2026-05-18: disclosed: NVD publication date
- 2026-05-18: advisory: GitHub Advisory published

## References

- [https://github.com/steipete/summarize/pull/219](https://github.com/steipete/summarize/pull/219)
- [https://github.com/steipete/summarize/commit/e64fe3ecd1bb4fdc181dcfa88c96b9e1914ced0e](https://github.com/steipete/summarize/commit/e64fe3ecd1bb4fdc181dcfa88c96b9e1914ced0e)
- [https://github.com/steipete/summarize/releases/tag/v0.15.2](https://github.com/steipete/summarize/releases/tag/v0.15.2)
- [https://www.vulncheck.com/advisories/summarize-unapproved-browser-automation-execution](https://www.vulncheck.com/advisories/summarize-unapproved-browser-automation-execution)
- [https://github.com/steipete/summarize/releases/tag/v0.15.1](https://github.com/steipete/summarize/releases/tag/v0.15.1)

## Related threats

- [steipete Summarize SSRF in podcast RSS transcript fetching](https://junglewise.ai/threats/cve-2026-53782-steipete-summarize-ssrf-in-podcast-rss-transcript-fetching)
- [steipete summarize disk exhaustion via uncapped media download](https://junglewise.ai/threats/cve-2026-53781-steipete-summarize-disk-exhaustion-via-uncapped-media-download)
- [steipete Summarize insecure file permissions in refresh-free path](https://junglewise.ai/threats/cve-2026-45246-steipete-summarize-insecure-file-permissions-in-refresh-free-path)
- [steipete Summarize SSRF via synthetic mouseover events](https://junglewise.ai/threats/cve-2026-45245-steipete-summarize-ssrf-via-synthetic-mouseover-events)
- [steipete Summarize missing authorization in content script bridge](https://junglewise.ai/threats/cve-2026-45243-steipete-summarize-missing-authorization-in-content-script-bridge)