CVE-2026-45243 affects the steipete summarize product versions before 0.15.1. The vulnerability arises from missing authorization checks in the content script's window.postMessage communication bridge. This allows attackers to simulate runtime messages with spoofed sender identifiers, enabling unauthorized access and manipulation of automation artifacts scoped to the affected browser tab. The vulnerability does not require privileges or user interaction beyond visiting a malicious page. No known exploits are reported in the wild, and no official remediation or patch has been published as of the data provided.

An attacker controlling a malicious web page can exploit this vulnerability to perform unauthorized operations on automation artifacts within the affected tab. This includes listing, reading, creating, overwriting, or deleting these artifacts. Such unauthorized access could lead to manipulation or disruption of automation workflows or data integrity within the affected environment. The vulnerability is exploitable remotely without privileges or user interaction beyond page visit, increasing its risk profile.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when visiting untrusted web pages and consider restricting or monitoring the use of the summarize extension in sensitive environments.