CVE-2026-0235: Prisma Browser Privilege Escalation Flaw

CVE-2026-0235 Overview

CVE-2026-0235 is a race condition vulnerability in Palo Alto Networks Prisma® Browser. The flaw allows a locally authenticated non-administrative user to bypass certain access and data control policies enforced by the browser. The weakness is categorized under [CWE-754] (Improper Check for Unusual or Exceptional Conditions) and stems from improper synchronization during policy evaluation.

The issue requires local access and low privileges, which narrows exploitation to users already on the endpoint. Successful exploitation undermines data loss prevention (DLP) and access controls that enterprises rely on the managed browser to enforce.

Critical Impact

A locally authenticated non-admin user can circumvent enterprise access and data control policies enforced by Prisma Browser, weakening DLP boundaries on managed endpoints.

Affected Products

• Palo Alto Networks Prisma® Browser
• Refer to the Palo Alto Networks security advisory for the affected version matrix
• Managed endpoints running Prisma Browser with enforced access or data control policies

Discovery Timeline

• 2026-05-13 - CVE CVE-2026-0235 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-0235

Vulnerability Analysis

The vulnerability is a race condition in the policy enforcement logic of Prisma Browser. Race conditions occur when the security state of a resource changes between the moment it is checked and the moment it is used. In this case, a non-admin user on the same endpoint can manipulate timing to perform browser actions before access and data control policies are fully applied.

The flaw is local in nature and requires the attacker to be authenticated on the host. Exploitation does not need user interaction from another party. The impact is concentrated on confidentiality, since policy bypass typically exposes restricted content or allows unauthorized data movement.

The vendor classifies the issue as medium severity, and there is no published proof-of-concept code. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Root Cause

The root cause is improper handling of an exceptional or timing-sensitive condition [CWE-754] during the evaluation and enforcement of browser policy. Policy checks and the actions they guard are not performed atomically. An attacker can exploit the window between the check and the enforcement to bypass DLP or access restrictions.

Attack Vector

The attack vector is local. A non-admin user authenticated to the endpoint repeatedly triggers actions that depend on policy enforcement, such as file uploads, downloads, clipboard operations, or restricted navigation. By winning the race, the user causes the action to complete before the corresponding control is applied. Verified technical specifics are limited to the Palo Alto Networks advisory; no verified proof-of-concept is publicly available.

Detection Methods for CVE-2026-0235

Indicators of Compromise

• Repeated, high-frequency browser actions from a single user that target controlled resources such as upload endpoints, clipboard, or restricted URLs
• Telemetry showing data egress or content access that contradicts the active Prisma Browser policy
• Successful operations on assets that policy should have blocked, recorded in browser or DLP logs

Detection Strategies

• Compare browser action logs against policy decision logs to identify discrepancies where a blocked action still completed
• Hunt for short-interval bursts of policy-relevant operations from non-admin accounts on managed endpoints
• Correlate endpoint process and file activity with browser session telemetry to spot policy-bypass patterns

Monitoring Recommendations

• Forward Prisma Browser audit and policy logs to a centralized SIEM for retention and correlation
• Alert on anomalies in user-driven data movement volumes, particularly to external or unmanaged destinations
• Track endpoint software inventory to confirm Prisma Browser is running a patched build across the fleet

How to Mitigate CVE-2026-0235

Immediate Actions Required

• Apply the fixed Prisma Browser version identified in the Palo Alto Networks advisory as soon as it is available
• Inventory endpoints running Prisma Browser and prioritize patching for hosts with sensitive data or elevated DLP requirements
• Review recent browser audit logs for evidence of policy bypass during the exposure window

Patch Information

Palo Alto Networks tracks the fix under its security advisory portal. Refer to the Palo Alto Networks CVE-2026-0235 advisory for the authoritative list of fixed versions and upgrade instructions. Apply vendor-supplied updates through the standard managed update channel for Prisma Browser.

Workarounds

• Restrict use of Prisma Browser on high-sensitivity endpoints until patched, where operationally feasible
• Tighten compensating data control policies at the network and endpoint DLP layer to reduce the value of a browser-level bypass
• Limit local logon rights on managed endpoints to reduce the population of users able to attempt local exploitation

# Configuration example
# Verify Prisma Browser version on managed endpoints and compare against the fixed release listed in the vendor advisory
# Windows (PowerShell)
Get-ItemProperty "HKLM:\Software\Palo Alto Networks\Prisma Browser" | Select-Object DisplayVersion

# macOS
defaults read "/Applications/Prisma Browser.app/Contents/Info.plist" CFBundleShortVersionString