This vulnerability (CVE-2026-0237) in Palo Alto Networks Prisma Browser for macOS is caused by improper protection of an alternate path to an internal automation bridge. A locally authenticated user without administrative privileges can leverage this exposed communication channel to send unauthorized commands to the browser, effectively bypassing security controls. The CVSS 4.0 vector indicates local attack vector with low attack complexity, requiring partial privileges but no user interaction, and results in high impact on confidentiality, integrity, and availability. The vendor has not provided a patch or official remediation as of the published date.

The vulnerability allows a local non-admin user to bypass security controls by sending unauthorized commands to the Prisma Browser via an exposed internal automation bridge. This can lead to unauthorized actions within the browser, potentially compromising confidentiality, integrity, and availability of browser operations on the affected macOS system. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to trusted users only and monitor for unusual local activity related to Prisma Browser. Avoid granting unnecessary local user privileges on affected systems.