The Pega Browser Extension contains a native messaging host flaw that can be triggered by a malicious website. When a user navigates to the compromised site the extension can display unexpected message boxes, potentially delivering unauthorized commands or data. The weakness is an improper access control issue, specifically CWE‑284, which may allow an attacker to send privileged messages to the extension or exploit its elevated permissions.

All users who have installed the Pega Browser Extension (PBE) as part of any version of Pega Robotic Automation are vulnerable. The vulnerability exists across every released version of the extension and therefore affects every Pega Robotic Automation deployment that utilizes PBE.

The CVSS score of 6.0 indicates a medium severity vulnerability while no EPSS score is currently published. The flaw can be exploited by hosting a malicious page that a user visits; no known public exploits exist, but the impact could range from deceptive message boxes to execution of privileged operations. Since the flaw is present in all versions and is not listed in the CISA KEV catalog, organisations should consider it a potential risk until a patch is applied.