An improperly protected alternate path in Palo Alto Networks Prisma Browser on macOS allows a locally authenticated non‑admin user to send unauthorized commands through an exposed internal automation bridge. This flaw bypasses the browser's security controls, enabling the execution of commands that should be restricted. The vulnerability is a classic case of improper access control (CWE‑424) and could potentially lead to unauthorized manipulation of browser state or content.

The affected vendor is Palo Alto Networks, product Prisma Browser running on macOS. All versions prior to 146.16.6.165 are vulnerable, as the official fix recommends upgrading to this release or newer. The issue is not limited to specific configurations, so any installation of older Prisma Browser versions on macOS should be considered impacted.

The CVSS score of 7.3 indicates a high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widely known public exploits at this time. However, the attacker model requires local system access and normal user authentication, meaning a threat actor with physical or remote access to a user’s machine could exploit the flaw. After exploitation the attacker can issue arbitrary commands to the browser, effectively bypassing security controls.