CVE-2026-45245: steipete Summarize SSRF via synthetic mouseover events

CVE-2026-45245 · Severity: high · CVSS 7.4 · Published 2026-05-18

Summarize is a Chrome extension that provides hover-based summaries of web content. A vulnerability in its hover summary feature allows attackers to trigger authenticated requests to local network endpoints by placing links to private IP addresses on malicious web pages. When users hover over these attacker-controlled links, the extension silently makes authenticated requests to internal services (like localhost:8787 or AWS metadata endpoints), potentially exposing sensitive information. While exploitation requires users to interact with attacker content and have specific extension settings enabled, successful attacks could expose internal network data.

Technologies: @steipete/summarize (npm), Steipete Summarize. Vendors: npm, Steipete.

Quick answers

Is CVE-2026-45245 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45245 being exploited in the wild.
How severe is CVE-2026-45245?
High severity, with a CVSS score of 7.4, published 18 May 2026.
Which products and versions are affected?
@steipete/summarize (npm) < 0.15.1, SEMVER:introduced=0,fixed=0.15.1; Steipete Summarize < 0.15.1, prior to 0.15.1.
Is there a fix for CVE-2026-45245?
Yes. @steipete/summarize (npm): upgrade to 0.15.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45245 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-45245?
Check whether you run @steipete/summarize (npm) or Steipete Summarize at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @steipete/summarize (npm): upgrade to 0.15.1 or later
    npm install @steipete/summarize@0.15.1

Technical details

The vulnerability exists in Summarize's hover summary feature, which allows untrusted synthetic mouseover events dispatched by page JavaScript to trigger authenticated daemon requests. The extension's content script did not validate event trustworthiness (event.isTrusted property), allowing page JavaScript to synthesize hover gestures. Additionally, the background hover controller accepted any URL without filtering for private, link-local, or loopback targets before using stored daemon credentials. This violated the extension's trust boundary, as a less-privileged page script could drive authenticated requests through the more-privileged background worker. The attack vector is network-based and requires user interaction (hovering); no authentication is required from the attacker. The fix (released in v0.15.1) enforces trusted event validation in the content script and adds URL allowlist logic rejecting localhost, .local, .localhost, private IPv4/IPv6, link-local, and loopback addresses before daemon token use. The CVSS v3.1 score of 3.1 reflects low practical exploitability due to prerequisite configuration and user interaction requirements.

Affected products

  • steipete Summarize prior to 0.15.1

Identifiers

  • CVE-2026-45245
  • GHSA-2r69-qgv3-hr65

Timeline

  • 2026-05-18: disclosed
  • 2026-05-29: advisory
  • 2026-05-15: patched: Security fix merged in PR #218; released in v0.15.1 on 2026-05-15

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.