CVE-2026-125361

high

Description

Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to impersonate the bsk daemon because remoteSocket() connects to the loopback WebSocket without credentials or peer verification. Attackers who bind the daemon port before it starts or after it exits receive the extension's full tool surface, including evaluate, to run JavaScript through CDP in logged-in browser tabs.

References

https://www.vulncheck.com/advisories/tencent-browserskill-through-0.4.2-missing-authentication-in-local-websocket-transport

https://github.com/Tencent/BrowserSkill/issues/402

https://github.com/Tencent/BrowserSkill/commit/7e862a44d19d0c1e492901fe29562cc7d79af590

https://github.com/Tencent/BrowserSkill/blob/ext-v0.4.2/apps/extension/src/transport/remote-endpoint.ts#L79-L85

https://github.com/Tencent/BrowserSkill

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-120524

Details

Source: Mitre, NVD

Published: 2026-11-10

Updated: 2026-11-12

Risk Information

CVSS v2

Base Score: 5.5

Vector: CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:N

Severity: Medium

CVSS v3

Base Score: 6.3

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Severity: Medium

CVSS v4

Base Score: 7.2

Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Severity: High

EPSS

EPSS: 0.00121