Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-125361

Tencent BrowserSkill through 0.4.2 Missing Authentication in Local WebSocket Transport

Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to impersonate the bsk daemon because remoteSocket() connects to the loopback WebSocket without credentials or peer verification. Attackers who bind the daemon port before it starts or after it exits receive the extension's full tool surface, including evaluate, to run JavaScript through CDP in logged-in browser tabs.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Tencent
Products
Browserskill
CVE-2026-94111

Tencent BrowserSkill through 0.3.0 Origin Validation Error in Local WebSocket Daemon

Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that accepts any chrome-extension origin with 32 characters in range a-p. Attackers can register a malicious extension as a browser client to intercept and manipulate page content, DOM, and screenshots returned to the AI agent.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Tencent
Products
Browserskill