This vulnerability (CVE-2026-0236) involves improper control of code generation (CWE-94) in Palo Alto Networks Prisma Browser on macOS. The issue stems from insufficient restrictions on the AppleScript interface, which allows a locally authenticated non-administrative user to leverage the exposed Apple Event handler to execute unauthorized commands within the browser context. The CVSS 4.0 vector indicates local attack vector, low attack complexity, partial privileges required, no user interaction, and high impact on confidentiality and integrity. No patch or official remediation level has been published as of the data provided.

A successful exploitation could allow a local non-admin user to execute unauthorized commands in the Prisma Browser via the AppleScript interface, potentially leading to code injection and compromise of browser integrity and confidentiality. The impact is rated high due to the ability to execute arbitrary commands locally, but it requires local access and partial privileges, limiting remote exploitation possibilities. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or mitigation level has been published, users should restrict local access to trusted users only and monitor for updates from Palo Alto Networks regarding patches or official mitigations. Avoid running Prisma Browser on macOS systems where untrusted local users have access until a fix is available.