CVE-2026-45173CWE-346

Idira Identity Browser Extension: Unauthorized Application Interaction via Origin Validation Failure

High · published June 11, 2026

CVSS v4.0
8.4
EPSS
0%
Percentile
11.3
In the wild
Unconfirmed
What it is

Idira Identity Browser Extension (Chrome, Firefox, and Edge builds) versions prior to 26.8.1 exhibit an origin validation flaw within its internal web-page verification routines. If an authenticated user navigates to a specially crafted webpage, this interaction could potentially allow a remote attacker to trigger unauthorized application interaction or execution parameters within the context of that authenticated browser session. CyberArk Security Bulletin: CA26-21

The record
Technical detail
CVSS v4.0
8.4 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N/U:Amber
EPSS
0.00215 · 11.3th percentile
Weakness
CWE-346 · Origin Validation Error
Published
2026-06-11T21:33Z
EPSS history
Timeline
  • 11 JUN 21:33Z
    Idira Identity Browser Extension: Unauthorized Application Interaction via Origin Validation Failure
    cvelistv5