PatchTheCVECVE-2026-45245: Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows malicious pages to
CVE-2026-45245 is a high-severity flaw (CVSS 7.4) affecting summarize. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links, causing the extension to make authenticated daemon requests using stored tokens without verifying event trustworthiness. Attackers can place local or private-network URLs behind hoverable links to route authenticated requests through the daemon, potentially accessing sen
Why this priority
- High severity
- Public exploit reference
A fixed release or distro patch exists.
Last updated 2026-10-14 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-45245?
summarize: upgrade to 0.15.1. Exact commands for each OS are on this page.
Is CVE-2026-45245 being exploited?
CVE-2026-45245 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-45245 affect?
CVE-2026-45245 affects summarize. Severity is high (CVSS 7.4). Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links, causing the extension to make authenticated daemon requests u
How urgent is CVE-2026-45245?
Priority 37/100. High severity; Public exploit reference
Related CVEs
- CVE-2026-45242 HIGH 7.1 UPGRADE Summarize prior to 0.15.1 contains a path traversal vulnerability in the /v1/summarize daemon endpoint that al
- CVE-2026-45243 MEDIUM 6.1 UPGRADE Summarize prior to 0.15.1 contains a missing authorization vulnerability in the content script window.postMess
- CVE-2026-45244 MEDIUM 5.4 UPGRADE Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows attackers to execute brow
- CVE-2026-45246 MEDIUM 5.5 UPGRADE Summarize prior to 0.15.1 contains an insecure file permission vulnerability in the refresh-free configuration