CVE-2026-45173 — Idira Identity Browser Extension: Unauthorized Application Interaction via Origin Validation Failure

CVE-2026-45173

Idira Identity Browser Extension: Unauthorized Application Interaction via Origin Validation Failure PUBLISHED

Description (CNA)

Idira Identity Browser Extension (Chrome, Firefox, and Edge builds) versions prior to 26.8.1 exhibit an origin validation flaw within its internal web-page verification routines. If an authenticated user navigates to a specially crafted webpage, this interaction could potentially allow a remote attacker to trigger unauthorized application interaction or execution parameters within the context of that authenticated browser session. CyberArk Security Bulletin: CA26-21

Affected (CNA)

Vendor / product	Versions
CyberArk Software, a Palo Alto Networks Company / Identity Browser Extensions	affected 26.0.0 before 26.8.1

CWE

CWE-346

References

https://docs.cyberark.com/find-identity-administration-docs/latest/en/content/getstarted/identity-new-doc-location.htm

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.