CVE-2026-125361 | BDVDB-2026-402605 Detail
TencentBrowserSkill
Description#
Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to impersonate the bsk daemon because remoteSocket() connects to the loopback WebSocket without credentials or peer verification. Attackers who bind the daemon port before it starts or after it exits receive the extension's full tool surface, including evaluate, to run JavaScript through CDP in logged-in browser tabs.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact none. Attack vector: local.
Weaknesses#
- CWE-923 Improper Restriction of Communication Channel to Intended Endpoints
References#
- https://github.com/Tencent/BrowserSkill/issues/402
- https://github.com/Tencent/BrowserSkill
- https://github.com/Tencent/BrowserSkill/blob/ext-v0.4.2/apps/extension/src/transport/remote-endpoint.ts#L79-L85
- https://github.com/Tencent/BrowserSkill/commit/7e862a44d19d0c1e492901fe29562cc7d79af590
- https://www.vulncheck.com/advisories/tencent-browserskill-through-0.4.2-missing-authentication-in-local-websocket-transport
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.