The vulnerability is a missing authorization check in the content script’s window.postMessage bridge. Malicious pages can craft spoofed messages that the extension accepts as originating from the extension itself, enabling the attacker to list, read, create, overwrite, or delete automation artifacts that belong to the affected tab.

The affected product is the Summarize browser extension from steipete, in any version prior to 0.15.1. Any browser that loads this extension and visits a page that can run JavaScript in the tab is susceptible.

The CVSS score of 5.3 classifies this as a moderate severity issue. EPSS data is not available, and it is not listed in CISA’s KEV catalog. The likely attack vector is a malicious webpage loaded in a tab where the extension is active; the attacker does not need special network privileges but must host a page that can send the crafted postMessage to the extension’s content script.