Attack Chain

1. Attacker crafts a malicious webpage containing attacker-controlled links.
2. The malicious webpage uses JavaScript to dispatch synthetic mouseover events targeting the attacker-controlled links.
3. The Summarize extension’s hover summary feature processes the synthetic mouseover event without proper validation.
4. The extension generates an authenticated request to the daemon, based on the link targeted by the mouseover event.
5. The attacker-controlled link points to a local or private network URL.
6. The extension routes the authenticated request to the specified local or private network URL.
7. If the local or private network URL corresponds to an internal endpoint without proper authorization checks, the attacker may gain unauthorized access.
8. Successful exploitation allows the attacker to read sensitive information from the internal endpoint.

Impact

Successful exploitation of CVE-2026-45245 can allow attackers to access sensitive internal endpoints through a user’s Summarize extension. By placing local or private-network URLs behind hoverable links, attackers can route authenticated requests through the daemon, bypassing network security measures. The impact includes unauthorized access to internal resources and potential data exfiltration.

Recommendation

• Upgrade the Summarize extension to version 0.15.1 or later to remediate CVE-2026-45245.
• Deploy the Sigma rule “Detect Summarize Extension Synthetic Mouseover Event” to identify potential exploitation attempts.
• Educate users about the risks of interacting with untrusted webpages and the potential for malicious mouseover events.