Missing Authentication Vulnerability in Tencent BrowserSkill

CVE-2026-125361

What is CVE-2026-125361?

The Tencent BrowserSkill extension through version 0.4.2 has a vulnerability that allows local attackers to impersonate the bsk daemon. This occurs due to the remoteSocket() method connecting to the loopback WebSocket without implementing required credentials or verifying peer authenticity. Consequently, if an attacker binds the daemon port either before the daemon starts or after it has exited, they can gain access to the extension's full tool capabilities. This includes executing JavaScript commands through the Chrome DevTools Protocol (CDP) within logged-in browser tabs, potentially resulting in unauthorized actions or data exposure.

References