Remote Code Execution in Bilibili Desktop

Executive Summary

CVE-2026-75357 is a critical vulnerability in Bilibili Desktop for Windows versions up to 1.17.9. It allows remote code execution due to improper validation of URLs in the in-app browser bridge. The main issue is that the application uses a flawed regex substring match to validate sender URLs instead of proper hostname parsing. This lets attackers bypass the allowlist by manipulating URLs, such as using userinfo components or hostname confusion. The vulnerability exposes privileged IPC channels, including one that can execute local files, enabling attackers to run arbitrary code on the victim's system with their user privileges.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if Bilibili Desktop version 1.17.9 or earlier is installed. Look for suspicious activity in the in-app browser, such as unexpected navigation to untrusted URLs or execution of local files. Monitor network traffic for connections to attacker-controlled hosts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on your system if you use an affected version of Bilibili Desktop. The attack requires minimal interaction, such as clicking a malicious link within the app's in-app browser. Successful exploitation could lead to data theft, malware installation, or further compromise of your system. Attackers could gain persistence, move laterally within your network, or deliver additional payloads without needing authentication or special privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations depending on the data processed by the affected application. GDPR requires protection of personal data, and a breach could result in fines or legal consequences. HIPAA mandates safeguards for protected health information, and exploitation could lead to unauthorized access. Organizations using Bilibili Desktop may need to assess their exposure and implement mitigations to maintain compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Bilibili Desktop to the latest version if available. Disable the in-app browser if possible. Restrict execution of local files via the application. Monitor for unusual system activity and unauthorized file executions.

Useful 0 Not Useful 0