CVE-2026-45244 affects the steipete summarize extension versions before 0.15.1. The vulnerability is a missing authorization control that permits attackers to execute browser automation actions without requiring user approval for each call, provided the extension automation feature is enabled. Attackers can leverage malicious content to influence the agent to invoke automation tools such as navigation or debugger-backed actions, bypassing the intended user consent mechanism. The CVSS 4.0 base score is 2.1, indicating low severity. There is no vendor advisory or patch information available at this time.

Attackers can bypass the per-call user approval step for browser automation actions when the extension automation feature is enabled, potentially allowing unauthorized automated interactions with the browser. However, the impact is limited by the requirement that the automation feature be enabled and user interaction with attacker-controlled content. The overall severity is low, and no known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the extension automation feature to prevent unauthorized automation actions. Monitor official vendor channels for updates or patches addressing this vulnerability.