A native messaging host vulnerability in Pega Browser Extension (PBE) affects users of all versions of Pega Robotic Automation who have installed Pega Browser Extension.

The primary impact of CVE-2026-1079 lies in the potential for a malicious website to trigger unexpected message boxes within the Pega Browser Extension. While the immediate impact might seem limited to a disruptive user experience, this vulnerability could be a stepping stone for more sophisticated attacks. An attacker could leverage the unexpected message box to trick users into revealing sensitive information or performing unintended actions. The blast radius extends to any user of Pega Robotic Automation who has the Pega Browser Extension installed and navigates to a compromised website. This vulnerability highlights the risks associated with native messaging hosts and the importance of secure browser extension development.

Organizations utilizing Pega Robotic Automation and its associated Pega Browser Extension are at risk. Specifically, users who frequently interact with external websites or those who have not recently updated their browser extensions are more vulnerable. Shared hosting environments where multiple users share the same browser instance could also amplify the risk.

• javascript / browser: Inspect browser extension permissions for unusual or excessive access requests. Monitor network traffic for suspicious connections originating from the Pega Browser Extension.

// Example: Check extension permissions in Chrome DevTools
chrome.permissions.getAll(function(permissions) {
  console.log(permissions);
});

1. 2026-04-07Disclosure

   disclosure

1. Gereserveerd2026-01-16
2. Gepubliceerd2026-04-07
3. EPSS bijgewerkt2026-04-15

The primary mitigation for CVE-2026-1079 is to upgrade the Pega Browser Extension to version 3.1.45 or later. This updated version includes the necessary fixes to address the native messaging host vulnerability. If immediate upgrading is not feasible, consider temporarily restricting access to untrusted websites and reviewing browser extension permissions. While a WAF or proxy cannot directly mitigate this vulnerability, they can help prevent users from accessing known malicious websites. After upgrading, confirm the fix by navigating to a known safe website and verifying that no unexpected message boxes are displayed.