prisma-access-browser-bin

maintainer mnabila · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary .deb from updates.talon-sec.com. Talon Cyber Security was acquired by Palo Alto Networks in 2024, and this domain appears to be the legitimate update infrastructure for Prisma Access Browser (formerly Talon's enterprise browser product). The URL pattern matches a proper Debian APT repository structure (dists/stable, pool/stable/main, binary-amd64/Packages), and the comment at the top even shows how to query that repo for new versions. However, talon-sec.com is not paloaltonetworks.com — it is a legacy domain from the acquired company, and there is no way to independently verify from the PKGBUILD alone that this is the canonical/official distribution channel vs. a third-party mirror or personal host. A prebuilt closed-source browser binary executed directly on the user's system from a non-primary vendor domain constitutes a real supply-chain concern: if the domain is ever abandoned, hijacked, or redirected, arbitrary code would execute with user privileges. The sha256sum provides integrity but not authenticity. This is a genuine medium-risk pattern — an executed proprietary binary from a non-primary vendor domain — not a false positive, though it is likely legitimate given the acquisition history.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:34 source=("https://updates.talon-sec.com/linux/${_pkgname}/deb/pool/stable/main/${_pkgname}-${_channel}_${pkgver}-1_amd64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary .deb from updates.talon-sec.com. Talon Cyber Security was acquired by Palo Alto Networks in 2024, and this domain appears to be the legitimate update infrastructure for Prisma Access Browser (formerly Talon's enterprise browser product). The URL pattern matches a proper Debian APT repository structure (dists/stable, pool/stable/main, binary-amd64/Packages), and the comment at the top even shows how to query that repo for new versions. However, talon-sec.com is not paloaltonetworks.com — it is a legacy domain from the acquired company, and there is no way to independently verify from the PKGBUILD alone that this is the canonical/official distribution channel vs. a third-party mirror or personal host. A prebuilt closed-source browser binary executed directly on the user's system from a non-primary vendor domain constitutes a real supply-chain concern: if the domain is ever abandoned, hijacked, or redirected, arbitrary code would execute with user privileges. The sha256sum provides integrity but not authenticity. This is a genuine medium-risk pattern — an executed proprietary binary from a non-primary vendor domain — not a false positive, though it is likely legitimate given the acquisition history.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: mnabila <nblid48 at gmail com>
    
      2
    
      3# Check for new releases:
    
      4# $ curl -sSf https://updates.talon-sec.com/linux/prisma-access-browser/deb/dists/stable/main/binary-amd64/Packages | grep -A2 "^Package: prisma-access-browser-stable" | grep Version | sort -V | tail -1
    
      5
    
      6pkgname=prisma-access-browser-bin
    
      7_pkgname=prisma-access-browser
    
      8pkgver=149.26.3.156
    
      9pkgrel=1
    
      10pkgdesc="Prisma Access Browser - the secure enterprise browser by Palo Alto Networks"
    
      11arch=('x86_64')
    
      12url="https://docs.paloaltonetworks.com/prisma-access-browser"
    
      13license=('custom')
    
      14depends=(
    
      15	'alsa-lib'
    
      16	'gtk3'
    
      17	'libcups'
    
      18	'libxss'
    
      19	'libxtst'
    
      20	'nss'
    
      21	'ttf-liberation'
    
      22	'xdg-utils'
    
      23)
    
      24optdepends=(
    
      25	'pipewire: WebRTC desktop sharing under Wayland'
    
      26	'kdialog: for file dialogs in KDE'
    
      27	'gnome-keyring: for storing passwords in GNOME keyring'
    
      28	'kwallet: for storing passwords in KWallet'
    
      29)
    
      30provides=("$_pkgname")
    
      31conflicts=("$_pkgname")
    
      32options=('!emptydirs' '!strip')
    
      33_channel=stable
    
      34source=("https://updates.talon-sec.com/linux/${_pkgname}/deb/pool/stable/main/${_pkgname}-${_channel}_${pkgver}-1_amd64.deb")
    
      35sha256sums=('2873743769f0b82aa87ed1747e1bd215febb49e57b55833461ff921fc69795a1')
    
      36
    
      37package() {
    
      38	bsdtar -xf data.tar.xz -C "$pkgdir/"
    
      39
    
      40	# Icons
    
      41	for i in 16 24 32 48 64 128 256; do
    
      42		install -Dm644 "$pkgdir/opt/paloaltonetworks/pab/product_logo_${i}.png" \
    
      43			"$pkgdir/usr/share/icons/hicolor/${i}x${i}/apps/${_pkgname}.png"
    
      44	done
    
      45
    
      46	# Remove the Debian cron job and duplicate product logos
    
      47	rm -r \
    
      48		"$pkgdir/etc/cron.daily/" \
    
      49		"$pkgdir/opt/paloaltonetworks/pab/cron/" \
    
      50		"$pkgdir/opt/paloaltonetworks/pab/product_logo_"*.png
    
      51}
    
      52

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 01:50:03	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2