Bilibili Desktop TLS Certificate Bypass Leads to RCE

Executive Summary

CVE-2026-86185 affects Bilibili Desktop versions up to 1.18.0. It disables TLS certificate verification system-wide and executes unsigned remote JavaScript configurations without integrity checks. An attacker can intercept configuration fetches, inject malicious JavaScript, and execute it with access to the privileged IPC bridge, enabling system commands or credential theft.

Useful 0 Not Useful 0

Detection Guidance

Check if Bilibili Desktop versions 1.17.9 or 1.18.0 are installed. Monitor network traffic for unsigned JavaScript configurations fetched from api.bilibili.com/x/elec-frontend/config/injectcode. Use tools like Wireshark to inspect TLS traffic for disabled certificate verification.

Useful 0 Not Useful 0

Impact Analysis

An attacker in your network can intercept your traffic, inject malicious JavaScript, and execute system commands or steal login credentials without your knowledge. This happens when you open external links in the app, as the injected code runs with full IPC bridge access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. The lack of proper encryption and integrity checks undermines compliance with these standards.

Useful 0 Not Useful 0

Mitigation Strategies

Uninstall Bilibili Desktop versions 1.17.9 and 1.18.0 immediately. Block outbound connections to api.bilibili.com/x/elec-frontend/config/injectcode. Use a firewall to restrict network access. Update to the latest version if a patched release is available.

Useful 0 Not Useful 0