This vulnerability (CVE-2026-1079) affects all versions of the Pega Browser Extension (PBE) associated with Pega Robotic Automation. It is classified as CWE-284 (Improper Access Control) and involves the native messaging host component of the extension. An attacker can craft a malicious website that, when visited by a user with the extension installed, causes the extension to display an unexpected message box. The CVSS 4.0 base score is 6.0 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, but requiring user interaction and resulting in high impact on availability (unexpected message box). There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

The vulnerability allows a remote attacker to cause the Pega Browser Extension to display an unexpected message box when a user visits a malicious website. This could disrupt user experience or potentially be used in social engineering attacks. There is no indication of data compromise, privilege escalation, or integrity violation. The impact is limited to availability disruption via unexpected UI behavior.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when visiting untrusted websites while the Pega Browser Extension is installed. No official mitigation or workaround has been provided by Pegasystems at this time.