Remote Code Execution Vulnerability in Bilibili Desktop by Bilibili Inc.
CVE-2026-75357

9.8CRITICAL

Key Information:

Vendor

Bilibili Inc.

Status
Bilibili Desktop
Vendor
CVE Published:
27 August 2026

What is CVE-2026-75357?

A vulnerability in Bilibili Desktop version 1.17.9 allows remote attackers to execute arbitrary code through the bili-inject.js and bili-bridge.js components. This critical flaw permits malicious actors to compromise user systems without authentication or user interaction, potentially leading to unauthorized data access and control over the targeted device.

References

https://github.com/LeoWSY-hashblue/bilibili-desktop-ipc-o...
https://github.com/LeoWSY-hashblue/cve-electron-2/blob/ma...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.