CVE-2026-45245

@@ -47,6 +47,61 @@ async function resolveHoverTabId(sender: chrome.runtime.MessageSender): Promise<
   return active?.id ?? null;
 }
 
+function isPrivateIpv4(hostname: string): boolean {
+  const parts = hostname.split(".");
+  if (parts.length !== 4) return false;
+  const octets = parts.map((part) => Number.parseInt(part, 10));
+  if (octets.some((octet, index) => !/^\d+$/.test(parts[index]) || octet < 0 || octet > 255)) {
+    return false;
+  }
+  const [first, second] = octets;
+  return (
+    first === 10 ||
+    first === 127 ||
+    (first === 172 && second >= 16 && second <= 31) ||
+    (first === 192 && second === 168) ||
+    (first === 169 && second === 254) ||
+    first === 0
+  );
+}
+
+function isPrivateIpv6Hostname(hostname: string): boolean {
+  const normalized = hostname.toLowerCase();
+  if (!normalized.startsWith("[") || !normalized.endsWith("]")) return false;
+  const address = normalized.slice(1, -1);
+  return (
+    address === "::1" ||
+    address.startsWith("fe8") ||
+    address.startsWith("fe9") ||
+    address.startsWith("fea") ||
+    address.startsWith("feb") ||
+    address.startsWith("fc") ||
+    address.startsWith("fd") ||
+    address === "::"
+  );
+}
+
+export function isHoverSummarizeUrlAllowed(rawUrl: string): boolean {
+  try {
+    const url = new URL(rawUrl);
+    if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+    const hostname = url.hostname.toLowerCase();
+    if (!hostname) return false;
+    if (
+      hostname === "localhost" ||
+      hostname.endsWith(".localhost") ||
+      hostname.endsWith(".local")
+    ) {
+      return false;
+    }
+    if (isPrivateIpv4(hostname)) return false;
+    if (isPrivateIpv6Hostname(hostname)) return false;
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 export function createHoverController({
   hoverControllersByTabId,
   buildDaemonRequestBody,
@@ -109,6 +164,18 @@ export function createHoverController({
       return;
     }
 
+    if (!isHoverSummarizeUrlAllowed(msg.url)) {
+      const message = "Hover summaries can only summarize public HTTP(S) URLs";
+      notifyStart({ ok: false, error: message });
+      await sendHover(tabId, {
+        type: "hover:error",
+        requestId: msg.requestId,
+        url: msg.url,
+        message,
+      });
+      return;
+    }
+
     try {
       logHover("start", { tabId, requestId: msg.requestId, url: msg.url });
       const base = buildDaemonRequestBody({

@@ -114,6 +114,10 @@ type HoverFromBg =
   | { type: "hover:done"; requestId: string; url: string }
   | { type: "hover:error"; requestId: string; url: string; message: string };
 
+export function shouldHandleHoverTriggerEvent(event: Pick<Event, "isTrusted">): boolean {
+  return event.isTrusted === true;
+}
+
 function ensureTooltip(): Tooltip {
   ensureStyle();
   let el = document.getElementById(TOOLTIP_ID) as HTMLDivElement | null;
@@ -394,6 +398,7 @@ export default defineContentScript({
     };
 
     document.addEventListener("mouseover", (event) => {
+      if (!shouldHandleHoverTriggerEvent(event)) return;
       const anchor = getAnchorFromEvent(event);
       if (!anchor) return;
       if (activeAnchor === anchor) {

@@ -0,0 +1,34 @@
+import { describe, expect, it } from "vitest";
+import { isHoverSummarizeUrlAllowed } from "../apps/chrome-extension/src/entrypoints/background/hover-controller.js";
+import { shouldHandleHoverTriggerEvent } from "../apps/chrome-extension/src/entrypoints/hover.content.js";
+
+describe("hover summary security boundaries", () => {
+  it("ignores synthetic hover events from page script", () => {
+    expect(shouldHandleHoverTriggerEvent({ isTrusted: false })).toBe(false);
+  });
+
+  it("accepts browser-trusted hover events", () => {
+    expect(shouldHandleHoverTriggerEvent({ isTrusted: true })).toBe(true);
+  });
+
+  it("rejects hover summaries for localhost and private literal hosts", () => {
+    expect(isHoverSummarizeUrlAllowed("http://127.0.0.1:8080/admin")).toBe(false);
+    expect(isHoverSummarizeUrlAllowed("http://[::1]:8080/admin")).toBe(false);
+    expect(isHoverSummarizeUrlAllowed("http://10.0.0.5/metadata")).toBe(false);
+    expect(isHoverSummarizeUrlAllowed("http://172.16.0.10/internal")).toBe(false);
+    expect(isHoverSummarizeUrlAllowed("http://192.168.1.20/router")).toBe(false);
+    expect(isHoverSummarizeUrlAllowed("http://169.254.169.254/latest/meta-data/")).toBe(false);
+    expect(isHoverSummarizeUrlAllowed("http://localhost:8787/health")).toBe(false);
+  });
+
+  it("allows ordinary public http and https URLs", () => {
+    expect(isHoverSummarizeUrlAllowed("https://example.com/article")).toBe(true);
+    expect(isHoverSummarizeUrlAllowed("http://example.com/article")).toBe(true);
+  });
+
+  it("rejects non-http hover summary URLs", () => {
+    expect(isHoverSummarizeUrlAllowed("file:///etc/passwd")).toBe(false);
+    expect(isHoverSummarizeUrlAllowed("javascript:alert(1)")).toBe(false);
+    expect(isHoverSummarizeUrlAllowed("notaurl")).toBe(false);
+  });
+});