The vulnerability arises from an origin validation flaw within the extension’s internal page verification, allowing an attacker to craft a malicious webpage that causes the extension to perform actions outside its intended scope. If an authenticated user visits such a page, the attacker could trigger unauthorized commands or adjust execution parameters within the browser session. The primary impact is that the attacker gains the same privileges as the authenticated user in the context of the extension, potentially facilitating further compromise of the user’s system.

CyberArk’s Identity Browser Extensions for Chrome, Edge, and Firefox versions earlier than 26.8.1 are affected. These extensions run in the user’s browser and are distributed by CyberArk, a Palo Alto Networks company.

The flaw has a CVSS score of 8.4, reflecting high severity. The EPSS value is not available, and the vulnerability is not currently listed in CISA’s KEV catalog, indicating no known publicly released exploits yet. However, the attack vector requires a social engineering or phishing scenario where an authenticated user is tricked into visiting a crafted webpage, making proactive application of the patch highly advisable.