Technical impact
The vulnerability is a code injection flaw in the AppleScript interface of Palo Alto Networks Prisma Browser on macOS. An attacker who is locally authenticated but not an administrator can abuse an exposed Apple Event handler to inject arbitrary AppleScript commands. This can lead to unauthorized browser control and could provide a foothold for data disclosure or lateral movement. The weakness is classified as CWE‑94.
Affected Systems
Palo Alto Networks Prisma Browser for macOS, versions prior to 146.16.6.165, are affected. The affected versions can be identified by their CPE entry, but the product is distributed under the Palo Alto Networks brand.
Risk and Exploitability
The CVSS score of 7.3 indicates a high severity with significant impact. EPSS is not available, so the exploitation probability cannot be quantified. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is local; it requires the user to be authenticated but does not require elevated privileges. Based on the description, it is inferred that the attacker would need to run a malicious AppleScript or trigger Apple Events to exercise the flaw, providing the attacker with control of the browser. Consequently, the risk is significant for any machine running an affected Prisma Browser instance with local user accounts having AppleScript access.
