This vulnerability (CWE-284: Improper Access Control) affects all versions of Pega Browser Extension integrated with Pega Robotic Automation. A malicious website can exploit the native messaging host interface to cause an unexpected message box to appear when a user visits the site. The CVSS 4.0 score is 6.0 (medium), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on availability. No known exploits are reported in the wild, and no vendor remediation or patch has been published as of the current data.

The impact is limited to the presentation of an unexpected message box triggered by visiting a malicious website. There is no indication of data confidentiality, integrity, or broader availability compromise. The vulnerability could cause user confusion or potential social engineering but does not directly lead to system compromise based on the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when visiting untrusted websites, especially if they have the Pega Browser Extension installed. Monitor vendor communications for updates on patches or mitigations.