CVE-2026-45243 describes a missing authorization vulnerability in the steipete summarize product prior to version 0.15.1. The vulnerability exists in the content script's window.postMessage bridge, which improperly trusts sender identifiers. This allows attackers to spoof runtime messages and perform unauthorized operations on automation artifacts scoped to the affected browser tab, including listing, reading, creating, overwriting, or deleting these artifacts. The vulnerability is remotely exploitable without privileges or user interaction beyond visiting a malicious page. The CVSS 4.0 score is 5.3 (medium severity). No patch or official remediation level has been published, and the product is not a cloud service. No known exploits have been reported.

An attacker controlling a malicious web page can exploit this vulnerability to manipulate automation artifacts within the context of the affected browser tab without authorization. This could lead to unauthorized access, modification, or deletion of automation data, potentially disrupting automated workflows or leaking sensitive information related to automation artifacts. The impact is limited to the scope of the affected tab and does not require elevated privileges or user interaction beyond page visit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor for updates from the vendor steipete regarding summarize. Until a fix is available, avoid visiting untrusted web pages while using affected versions of summarize. Do not rely on generic mitigations as the vulnerability specifically involves the window.postMessage bridge authorization.