The Summarize browser extension before version 0.15.1 contains an SSRF vulnerability in its hover summary feature. Attackers can dispatch synthetic mouseover events on links they control, causing the extension to send authenticated requests to internal or local network endpoints via the daemon using stored tokens. The extension does not verify the trustworthiness of these events, enabling potential unauthorized access to sensitive internal resources. There is no official patch or remediation level currently stated.

An attacker can exploit this vulnerability to cause the extension to make authenticated requests to local or private network URLs on behalf of the user. This may expose sensitive internal endpoints or data accessible only within the user's network environment. The impact is limited by user interaction (UI required) and the medium severity score reflects the moderate risk of unauthorized internal network access without privilege requirements.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid interacting with untrusted or suspicious content that could trigger synthetic mouseover events in the Summarize extension. Monitoring for updates from the vendor is recommended to apply any forthcoming patches promptly.