CVE-2026-125361
6.3 MEDIUMpublic exploit availablePublished 2026-11-10 · Updated 2026-11-10
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to impersonate the bsk daemon because remoteSocket() connects to the loopback WebSocket without credentials or peer verification. Attackers who bind the daemon port before it starts or after it exits receive the extension's full tool surface, including evaluate, to run JavaScript through CDP in logged-in browser tabs.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-923
Public exploit & PoC references
All references
- https://github.com/Tencent/BrowserSkill
- https://github.com/Tencent/BrowserSkill/blob/ext-v0.4.2/apps/extension/src/transport/remote-endpoint.ts#L79-L85
- https://github.com/Tencent/BrowserSkill/commit/7e862a44d19d0c1e492901fe29562cc7d79af590
- https://github.com/Tencent/BrowserSkill/issues/402
- https://www.vulncheck.com/advisories/tencent-browserskill-through-0.4.2-missing-authentication-in-local-websocket-transport
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- UNSCOREDCVE-2026-101891
- MEDIUMCVE-2026-102085
- UNSCOREDCVE-2026-102727PoC
- UNSCOREDCVE-2026-10756
- MEDIUMCVE-2026-110909PoC
- MEDIUMCVE-2026-119914
- HIGHCVE-2026-70212
- UNSCOREDCVE-2026-82932
Related by shared AI tags and CWE weakness class. Browse the full archive.