Authentication Bypass Vulnerability in Tencent BrowserSkill WebSocket Validation

CVE-2026-94111

What is CVE-2026-94111?

Tencent BrowserSkill versions prior to 0.3.0 are susceptible to an authentication bypass vulnerability associated with the local daemon's WebSocket origin validation. This flaw permits the acceptance of any chrome-extension origin consisting of 32 characters within the 'a-p' range. As a result, an attacker could register a malicious extension, which could then intercept and modify the page's content, manipulate the DOM, and capture screenshots produced by the AI agent. This vulnerability poses significant risks as it opens the door for potential exploitation in compromised browser environments.

References