Threat Intelligence Database

A local privilege escalation vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated administrator with access to the macOS local filesystem to perform actions on the device with root privileges. This issue only affects Prisma® Browser on macOS.

CVE-2026-0237 is a high-severity vulnerability in Palo Alto Networks Prisma Browser on macOS. It involves improper protection of an alternate path that exposes an internal automation bridge. This flaw allows a locally authenticated non-admin user to send unauthorized commands to the browser by leveraging this exposed communication channel, effectively bypassing security controls. The vulnerability has a CVSS 4.0 score of 7.3, indicating significant impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

A sensitive information disclosure vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated non-admin user to retrieve sensitive data from Prisma Browser. Browser self-protection should be enabled to mitigate this issue.

MediumVulnerabilityGermanyFranceUnited Kingdom+7#cve#cve-2025-4618#cwe-316

CVE-2025-4617 is a low-severity vulnerability in Palo Alto Networks Prisma Browser on Windows that allows a locally authenticated non-admin user to bypass the browser's screenshot control feature due to improper protection of an alternate path. Exploitation requires local access with standard user privileges and does not require user interaction. The vulnerability stems from insufficient policy enforcement, specifically related to the browser's self-protection mechanisms. There are no known exploits in the wild, and no patches have been released yet. The impact is limited to confidentiality as it enables unauthorized screenshots, potentially exposing sensitive information. European organizations using Prisma Browser should ensure browser self-protection is enabled and restrict local user access to trusted personnel. Countries with significant Palo Alto Networks deployments and critical infrastructure are more likely to be affected. Overall, the threat is low severity but should be monitored and mitigated proactively.

LowVulnerabilityGermanyFranceNetherlands+4#cve#cve-2025-4617#cwe-424

An insufficient validation of an untrusted input vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated non-admin user to revert the browser’s security controls.

LowVulnerabilityGermanyUnited KingdomFrance+4#cve#cve-2025-4616#cwe-354