Description
Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links, causing the extension to make authenticated daemon requests using stored tokens without verifying event trustworthiness. Attackers can place local or private-network URLs behind hoverable links to route authenticated requests through the daemon, potentially accessing sensitive internal endpoints when users interact with attacker-controlled content.
CVSS breakdown
CVSS 4.0
Attack Vector
Network
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
None
User Interaction
Active
Confidentiality (Vulnerable System)
Low
Integrity (Vulnerable System)
None
Availability (Vulnerable System)
None
Confidentiality (Subsequent System)
High
Integrity (Subsequent System)
None
Availability (Subsequent System)
None
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
Affected products
- steipete / summarize0 – 0.15.1
- steipete / summarizeecbb2c414255aa480a15d0d8b205224c14cfdbcb – ecbb2c414255aa480a15d0d8b205224c14cfdbcb
References
- PATCHhttps://github.com/steipete/summarize/releases/tag/v0.15.2
- PATCHhttps://github.com/steipete/summarize/pull/218
- PATCHhttps://github.com/steipete/summarize/commit/ecbb2c414255aa480a15d0d8b205224c14cfdbcb
- VENDOR_ADVISORYhttps://www.vulncheck.com/advisories/summarize-unauthorized-daemon-request-via-untrusted-events