CVE-2026-45173

Analyzed Analyzed - Analysis Complete

Origin Validation Flaw in Idira Identity Browser Extension

Publication date: 2026-06-11

Last updated on: 2026-06-22

Assigner: Palo Alto Networks, Inc.

Description

Idira Identity Browser Extension (Chrome, Firefox, and Edge builds) versions prior to 26.8.1 exhibit an origin validation flaw within its internal web-page verification routines. If an authenticated user navigates to a specially crafted webpage, this interaction could potentially allow a remote attacker to trigger unauthorized application interaction or execution parameters within the context of that authenticated browser session. CyberArk Security Bulletin: CA26-21

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-11

Last Modified

2026-06-22

Generated

2026-07-02

AI Q&A

2026-06-12

EPSS Evaluated

2026-06-30

NVD

CVE-2026-45173

EUVD

EUVD-2026-36363

Affected Vendors & Products

Vendor	Product	Version / Range
paloaltonetworks	idira_identity_browser_extension	From 26.0.0 (inc) to 26.8.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-346	The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

Compliance Impact

The provided information does not specify how the Idira Identity Browser Extension vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Executive Summary

The vulnerability exists in the Idira Identity Browser Extension (for Chrome, Firefox, and Edge) versions prior to 26.8.1. It involves an origin validation flaw in the extension's internal web-page verification routines. This flaw means that if an authenticated user visits a specially crafted webpage, a remote attacker could exploit this to trigger unauthorized interactions or execution parameters within the context of the user's authenticated browser session.

Impact Analysis

This vulnerability could allow a remote attacker to perform unauthorized actions within the authenticated browser session of the user. This means the attacker might be able to manipulate the application or execute commands without the user's consent, potentially leading to data compromise, unauthorized access, or other malicious activities.

Hi! I’m here to help you understand CVE-2026-45173. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70