CVE-2026-1079
Medium
Description
A native messaging host vulnerability in Pega Browser Extension (PBE) affects users of all versions of Pega Robotic Automation who have installed Pega Browser Extension. A bad actor could create a website that contains malicious code that targets PBE. The vulnerability could occur if a user navigates to this website. The malicious website could then present an unexpected message box.
SeverityMedium
CVSS6.0
Exploit probability19. percentile0.3%
ProductPega Browser Extension (PBE)
PublishedApr 7, 2026
First seenApr 7, 2026
Weakness typeCWE-284Improper access control
How to fix
Update
- Pegasystems Pega Browser Extension (PBE)3.1.45 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Pegasystems Pega Browser Extension (PBE) | v < 3.1.45 | 3.1.45 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.