HIGH 7.2 NVD
CVE-2026-125361
Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to impersonate the bsk daemon because remoteSocke
Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to impersonate the bsk daemon because remoteSocket() connects to the loopback WebSocket without credentials or peer verification. Attackers who bind the daemon port before it starts or after it exits receive the extension's full tool surface, including evaluate, to run JavaScript through CDP in logged-in browser tabs.
References
- https://github.com/Tencent/BrowserSkill
- https://github.com/Tencent/BrowserSkill/blob/ext-v0.4.2/apps/extension/src/transport/remot
- https://github.com/Tencent/BrowserSkill/commit/7e862a44d19d0c1e492901fe29562cc7d79af590
- https://github.com/Tencent/BrowserSkill/issues/402
- https://www.vulncheck.com/advisories/tencent-browserskill-through-0.4.2-missing-authentica
This high severity vulnerability with a CVSS score of 7.2 was published on 2026-11-10 via NVD.
vulnfeed aggregates 17092 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.