CVE-2026-45173: Idira Identity Browser Extension Origin Validation Flaw (CVSS 6.5)

Technical summary

CVE-2026-45173 is an origin validation vulnerability (CWE-346) in Idira Identity Browser Extension versions <26.8.1 across Chrome, Firefox, and Edge. The extension fails to properly verify the origin of web pages before executing sensitive operations, allowing an attacker to craft a malicious webpage that, when visited by an authenticated user, could trigger unauthorized application interactions or parameter manipulation within that user's authenticated context. The CVSS v3.1 score of 6.5 (MEDIUM) reflects network-accessible exploitation requiring user interaction, with high integrity impact but no confidentiality or availability loss.

Business impact

Organizations deploying Idira Identity Browser Extension for workforce identity and credential management face a risk of unauthorized actions being performed on behalf of authenticated users. An attacker could potentially modify settings, approve unauthorized requests, or trigger unintended identity-related transactions without the user's knowledge. The medium severity and requirement for user interaction limit the blast radius, but the integrity impact—particularly if users manage sensitive access or approvals through the extension—warrants prompt remediation to prevent account compromise or unauthorized policy changes.

Affected systems

Idira Identity Browser Extension versions prior to 26.8.1 are affected across all three major browser platforms: Google Chrome, Mozilla Firefox, and Microsoft Edge (Chromium-based). Any organization or user running the extension on these browsers with versions below 26.8.1 is exposed. The underlying browsers themselves (Chrome, Firefox, Edge) are not vulnerable; the flaw resides solely in the extension code.

Exploitability

Exploitation requires network access and user interaction—specifically, an authenticated user must navigate to an attacker-controlled or compromised webpage. There is no CVSS complexity multiplier, indicating the attack does not demand special conditions beyond creating a malicious site. The low barrier to delivery (any webpage) combined with the high likelihood that users visit untrusted sites makes this a practical threat in targeted phishing or watering-hole scenarios. However, the extension must already be installed and the user must be authenticated for impact to occur.

Remediation

Update Idira Identity Browser Extension to version 26.8.1 or later. Patches are available across all supported browser platforms. Users should enable automatic updates if available. Organizations should verify compatibility with existing identity workflows and test the patched extension in a non-production environment before broad deployment.

Patch guidance

Upgrade Idira Identity Browser Extension to 26.8.1 or later immediately. For Chrome users, updates typically deploy automatically via the Chrome Web Store; verify via Settings > Extensions that the version shown is 26.8.1 or higher. Firefox and Edge users should similarly check their extension management interfaces and ensure auto-update is enabled. Verify the updated version against the official Palo Alto Networks advisory (CyberArk Security Bulletin CA26-21) to confirm patch installation. For organizations with managed browser deployments, use your group policy or extension management console to enforce version 26.8.1 or later.

Detection guidance

Monitor for browser extension update compliance and flag systems still running Idira Identity Browser Extension versions below 26.8.1 using your endpoint detection and response (EDR) or mobile device management (MDM) solution. Review access logs and authentication events for any unusual or suspicious identity-related actions performed shortly after a user visited unfamiliar websites. Network-based indicators are limited since the attack surface is client-side; focus on behavioral anomalies such as unexpected approval workflows or setting changes tied to browsing activity. Security teams can audit installed extension versions through browser telemetry if centrally managed.

Why prioritize this

A MEDIUM severity integrity-impacting vulnerability in an identity management extension warrants prompt but not emergency action. The requirement for user interaction and prior authentication limits the attack surface compared to critical vulnerabilities, but the involvement of credential and identity management makes even one successful exploitation meaningful. Prioritize systems where the extension manages sensitive approvals, policy changes, or privileged access. Teams should patch within the next 1–2 weeks, with higher urgency for users in security-sensitive roles.

Risk score, explained

The CVSS v3.1 score of 6.5 reflects a network-accessible flaw (AV:N) with low attack complexity (AC:L) and no privilege requirement (PR:N), but mandatory user interaction (UI:R). The unchanged security scope (S:U) and absence of confidentiality or availability loss are offset by high integrity impact (I:H), meaning an attacker can modify or manipulate identity-related actions. This scoring aligns with a practical threat vector in phishing or social engineering scenarios targeting authenticated extension users, justifying medium rather than high or critical severity.

Frequently asked questions