Junglewise Threat Intelligence

CVE-2026-45245: steipete Summarize SSRF via synthetic mouseover events

CVE-2026-45245 · Severity: high · CVSS 7.4 · Published 2026-05-18

Technologies: Steipete Summarize, @steipete/summarize (npm). Vendors: Steipete, npm.

Executive brief

Summarize is a Chrome extension that provides hover-based summaries of web content. A vulnerability in its hover summary feature allows attackers to trigger authenticated requests to local network endpoints by placing links to private IP addresses on malicious web pages. When users hover over these attacker-controlled links, the extension silently makes authenticated requests to internal services (like localhost:8787 or AWS metadata endpoints), potentially exposing sensitive information. While exploitation requires users to interact with attacker content and have specific extension settings enabled, successful attacks could expose internal network data.

Technical details

The vulnerability exists in Summarize's hover summary feature, which allows untrusted synthetic mouseover events dispatched by page JavaScript to trigger authenticated daemon requests. The extension's content script did not validate event trustworthiness (event.isTrusted property), allowing page JavaScript to synthesize hover gestures. Additionally, the background hover controller accepted any URL without filtering for private, link-local, or loopback targets before using stored daemon credentials. This violated the extension's trust boundary, as a less-privileged page script could drive authenticated requests through the more-privileged background worker. The attack vector is network-based and requires user interaction (hovering); no authentication is required from the attacker. The fix (released in v0.15.1) enforces trusted event validation in the content script and adds URL allowlist logic rejecting localhost, .local, .localhost, private IPv4/IPv6, link-local, and loopback addresses before daemon token use. The CVSS v3.1 score of 3.1 reflects low practical exploitability due to prerequisite configuration and user interaction requirements.

Affected products

  • steipete Summarize prior to 0.15.1

Timeline

  • 2026-05-18: disclosed
  • 2026-05-29: advisory
  • 2026-05-15: patched: Security fix merged in PR #218; released in v0.15.1 on 2026-05-15

References

Related threats