CVE-2026-45173 is an origin validation vulnerability (CWE-346) in CyberArk Software's Idira Identity Browser Extensions (Chrome, Firefox, Edge). Versions prior to 26.8.1 improperly validate the origin of internal web-page interactions. An attacker can exploit this by luring an authenticated user to a malicious webpage, which may trigger unauthorized application interactions or execution parameters within the authenticated browser session context. This could lead to unauthorized actions being performed without the user's explicit consent.

Successful exploitation could allow a remote attacker to perform unauthorized interactions or execute parameters within the context of an authenticated browser session, potentially compromising the security of the user's session and associated resources. The vulnerability requires user interaction (visiting a crafted webpage) and does not require privileges or authentication by the attacker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch link is provided at this time. Users should monitor CyberArk's security bulletins for updates and apply any forthcoming patches or updates promptly. Until a fix is available, users should exercise caution when visiting untrusted websites while using affected versions of the extension.