CVE-2026-125361
Received Received - Intake

Tencent BrowserSkill Missing Authentication Local Privilege Escalation

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: VulnCheck

Description
Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to impersonate the bsk daemon because remoteSocket() connects to the loopback WebSocket without credentials or peer verification. Attackers who bind the daemon port before it starts or after it exits receive the extension's full tool surface, including evaluate, to run JavaScript through CDP in logged-in browser tabs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-125361
EUVD
EUVD-2026-120524

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Tencent BrowserSkill From 0 (inc) to 0.4.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-923 The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-125361 is a missing authentication vulnerability in Tencent BrowserSkill through version 0.4.2. The issue allows local attackers to impersonate the bsk daemon by exploiting the remoteSocket() function, which connects to a loopback WebSocket without credentials or peer verification. Attackers can bind to the daemon port before it starts or after it exits, gaining full control over the extension's tool surface, including executing JavaScript through the Chrome DevTools Protocol in logged-in browser tabs.

Detection Guidance

Check if the BrowserSkill extension is running and listening on a local WebSocket port. Use commands like 'netstat -tulnp | grep -i websocket' or 'ss -tulnp | grep -i websocket' to identify open ports. Look for unexpected connections to loopback addresses (127.0.0.1) on ports typically used by BrowserSkill.

Impact Analysis

This vulnerability allows local attackers to execute arbitrary JavaScript in your browser tabs via the Chrome DevTools Protocol. This could lead to session hijacking, data theft, or unauthorized actions in your authenticated browser profile. Since the attack requires local access, it primarily affects users who have untrusted software running on their systems.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using BrowserSkill must ensure proper access controls are implemented to prevent such local attacks, as compliance often requires demonstrating protection against unauthorized data access.

Mitigation Strategies

Update BrowserSkill to the latest version that includes mutual local pairing and WebSocket authentication. If an update is not available, disable the BrowserSkill extension until a patch is released. Monitor for unauthorized JavaScript execution in browser tabs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125361. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...