CyberCVE

CVE-2026-45173

Idira Identity Browser Extension: Unauthorized Application Interaction via Origin Validation Failure

Severity
High 8.4
CVSS 4.0
Exploited
Not listed
EPSS
0.002
5.8th percentile
Discovered by
Vendor
Published by the vendor
Published
Jun 11, 2026
Assigned by palo_alto

Description

Idira Identity Browser Extension (Chrome, Firefox, and Edge builds) versions prior to 26.8.1 exhibit an origin validation flaw within its internal web-page verification routines. If an authenticated user navigates to a specially crafted webpage, this interaction could potentially allow a remote attacker to trigger unauthorized application interaction or execution parameters within the context of that authenticated browser session. CyberArk Security Bulletin: CA26-21

Weakness: CWE-346

Affected products

Vendor Product Category Matched by

No product mapping yet — this CVE is pending taxonomy review.

Vendor-reported affected versions (1)
  • CyberArk Software, a Palo Alto Networks Company · Identity Browser Extensions

Credit

Palo Alto Networks thanks our internal security research teams for discovering and reporting this issue

References