CVE-2026-45245

216.73.217.86

· Published 18/05/2026 20:16 · Modified 19/05/2026 01:34

Labels: CVE-2026-45245 2026-05-18 CVE-2026-45245 CWE-918 [email protected]

Essential information

Published: 18/05/2026 20:16
Modified: 19/05/2026 01:34
Author: —
Creator: —
CVSS: 4.6 MEDIUM (v3) 4.6 MEDIUM (v4.0)
CISA KEV: No
CWE: —
CVSS vector: —

CVSS metrics

Description

Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links, causing the extension to make authenticated daemon requests using stored tokens without verifying event trustworthiness. Attackers can place local or private-network URLs behind hoverable links to route authenticated requests through the daemon, potentially accessing sensitive internal endpoints when users interact with attacker-controlled content.

NVD status

Status: Analyzed — CVE is currently being analyzed by NVD staff, this process results in association of reference link tags, CVSS scores, CWE association, and CPE applicability statements.
Source: [email protected]
NVD: View on NVD

Affected products (CPE)

Product	CPE
steipete / summarize	`cpe:2.3:a:steipete:summarize::::::::`