CVE-2026-0236
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A code injection vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to its AppleScript interface, allowing a locally authenticated non-admin user to leverage this exposed Apple Event handler to send unauthorized commands to the browser.
Risk Assessment
The risk for the organization is that a local user can execute unauthorized actions in the browser, potentially leading to data confidentiality breaches, configuration modifications, or privilege escalation within the browser context.
Recommendation
It is recommended to immediately apply the vendor-provided update for Palo Alto Networks Prisma® Browser on macOS and restrict system access to trusted users only.
Other vulnerabilities in Palo Alto Networks Prisma Browser
See all- CVE-2026-0290Low
An information disclosure vulnerability in the Account Protection feature of Palo Alto Networks Prisma Browser enables a local attacker to view sensitive data.
- CVE-2026-0289Low
A security bypass vulnerability in the Account Protection feature of Palo Alto Networks Prisma Browser enables a user to bypass intended security controls.
- CVE-2026-0237High
An improper protection of alternate path vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to an internal automation bridge. This allows a locally authenticated non-admin user to leverage an exposed communication channel to send unauthorized commands to the browser, bypassing security controls.
Original NVD description (English source)
A code injection vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to its AppleScript interface allowing a locally authenticated non-admin user to leverage this exposed Apple Event handler to send unauthorized commands to the browser.