CVE-2026-1079
MediumCVSS 6.0Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A native messaging host vulnerability in Pega Browser Extension (PBE) affects users of all versions of Pega Robotic Automation who have installed PBE. A malicious website could contain code targeting PBE and present an unexpected message box if a user navigates to it.
Risk Assessment
An attacker could exploit the vulnerability to display unexpected messages and potentially mislead the user, undermining trust in the extension and enabling further social engineering attacks.
Recommendation
Update Pega Browser Extension to the latest version if a fix is available, and inform users about the risks of visiting unknown websites. Consider limiting extension permissions.
Other vulnerabilities in Pega Browser Extension
See all- CVE-2026-0898Critical
An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers automating Google Chrome and Microsoft Edge in versions 22.1 or R25. It does not affect Robot Runtime users. An attacker could create a malicious website, and the vulnerability may be exploited if a developer is tricked into visiting it during interrogation mode in Robot Studio.
- CVE-2026-1078High
An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robotic Automation version 22.1 or R25 users running automations with Google Chrome or Microsoft Edge. A malicious website could exploit this if a Robot Runtime user navigates to it.
Original NVD description (English source)
A native messaging host vulnerability in Pega Browser Extension (PBE) affects users of all versions of Pega Robotic Automation who have installed Pega Browser Extension. A bad actor could create a website that contains malicious code that targets PBE. The vulnerability could occur if a user navigates to this website. The malicious website could then present an unexpected message box.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS