Skip to content
CVE PROGRAM SOURCE RECORD7.3 High

CVE-2026-0236

Prisma Browser: Code Injection Enables Security Controls Bypass

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
palo_alto

Description

A code injection vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to its AppleScript interface allowing a locally authenticated non-admin user to leverage this exposed Apple Event handler to send unauthorized commands to the browser.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Palo Alto Networks Prisma Browser

Default version status: unaffected

  • 0 to < 146.16.6.165affected

References