This vulnerability (CVE-2026-0236) involves improper control of code generation (CWE-94) in the Prisma Browser for macOS by Palo Alto Networks. The application fails to properly restrict access to its AppleScript interface, which can be leveraged by a locally authenticated non-administrative user to inject code by sending unauthorized Apple Events to the browser. This can lead to potentially high-impact consequences given the elevated privileges of the Apple Event handler. The CVSS 4.0 vector indicates local attack vector with low attack complexity, requiring privileges but no user interaction, and results in high confidentiality and integrity impact.

An attacker with local non-admin access can exploit this vulnerability to execute unauthorized commands within the Prisma Browser context on macOS. This could lead to unauthorized code execution, potentially compromising browser data or behavior. However, exploitation requires local access and no known exploits are reported in the wild. The impact is rated high due to the potential for code injection and unauthorized command execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently available, users should restrict local access to trusted users only and monitor for updates from Palo Alto Networks regarding patches or mitigations. Avoid granting unnecessary local access to systems running Prisma Browser on macOS until a fix is released.