CVE-2026-0235
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A race condition vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated non-admin user to bypass certain access and data control policies.
Risk Assessment
The organization faces the risk of security policy violations, potentially leading to unauthorized access to sensitive data or system functions.
Recommendation
It is recommended to immediately apply patches provided by Palo Alto Networks and restrict local access to the browser to trusted users only.
Other vulnerabilities in Prisma Browser
See all- CVE-2026-0275Medium
A local privilege escalation vulnerability in Palo Alto Networks Prisma® Browser on macOS allows a locally authenticated administrator with access to the local filesystem to perform actions with root privileges.
- CVE-2025-4618Medium
A sensitive information disclosure vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated non-admin user to retrieve sensitive data from Prisma Browser. Browser self-protection should be enabled to mitigate this issue.
- CVE-2025-4617Low
An insufficient policy enforcement vulnerability in Palo Alto Networks Prisma® Browser on Windows allows a locally authenticated non-admin user to bypass the screenshot control feature of the browser. Browser self-protection should be enabled to mitigate this issue.
- CVE-2025-4616Low
An insufficient validation of an untrusted input vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated non-admin user to revert the browser’s security controls.
Original NVD description (English source)
A race condition vulnerability in Palo Alto Networks Prisma® Browser enables a locally authenticated non-admin user to bypass certain access and data control policies.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS