{"api_version":"1","generated_at":"2026-11-10T12:34:19+00:00","cve":"CVE-2026-125361","urls":{"html":"https://cve.report/CVE-2026-125361","api":"https://cve.report/api/cve/CVE-2026-125361.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-125361","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-125361"},"summary":{"title":"Tencent BrowserSkill through 0.4.2 Missing Authentication in Local WebSocket Transport","description":"Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to impersonate the bsk daemon because remoteSocket() connects to the loopback WebSocket without credentials or peer verification. Attackers who bind the daemon port before it starts or after it exits receive the extension's full tool surface, including evaluate, to run JavaScript through CDP in logged-in browser tabs.","state":"PUBLISHED","assigner":"VulnCheck","published_at":"2026-11-10 00:17:07","updated_at":"2026-11-10 00:17:07"},"problem_types":["CWE-923","CWE-923 Improper Restriction of Communication Channel to Intended Endpoints"],"metrics":[{"version":"4.0","source":"disclosure@vulncheck.com","type":"Secondary","score":"7.2","severity":"HIGH","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","data":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}},{"version":"4.0","source":"CNA","type":"CVSS","score":"7.2","severity":"HIGH","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","data":{"attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","baseScore":7.2,"baseSeverity":"HIGH","privilegesRequired":"LOW","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH"}},{"version":"3.1","source":"disclosure@vulncheck.com","type":"Primary","score":"6.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"6.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","data":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}}],"references":[{"url":"https://github.com/Tencent/BrowserSkill/issues/402","name":"https://github.com/Tencent/BrowserSkill/issues/402","refsource":"disclosure@vulncheck.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/Tencent/BrowserSkill/commit/7e862a44d19d0c1e492901fe29562cc7d79af590","name":"https://github.com/Tencent/BrowserSkill/commit/7e862a44d19d0c1e492901fe29562cc7d79af590","refsource":"disclosure@vulncheck.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.vulncheck.com/advisories/tencent-browserskill-through-0.4.2-missing-authentication-in-local-websocket-transport","name":"https://www.vulncheck.com/advisories/tencent-browserskill-through-0.4.2-missing-authentication-in-local-websocket-transport","refsource":"disclosure@vulncheck.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/Tencent/BrowserSkill","name":"https://github.com/Tencent/BrowserSkill","refsource":"disclosure@vulncheck.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/Tencent/BrowserSkill/blob/ext-v0.4.2/apps/extension/src/transport/remote-endpoint.ts#L79-L85","name":"https://github.com/Tencent/BrowserSkill/blob/ext-v0.4.2/apps/extension/src/transport/remote-endpoint.ts#L79-L85","refsource":"disclosure@vulncheck.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-125361","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125361","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Tencent","product":"BrowserSkill","version":"affected 0.4.2 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"George Chen","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/browser-skill","product":"BrowserSkill","vendor":"Tencent","versions":[{"lessThanOrEqual":"0.4.2","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"George Chen"}],"datePublic":"2026-10-05T00:00:00.000Z","descriptions":[{"lang":"en","value":"Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to impersonate the bsk daemon because remoteSocket() connects to the loopback WebSocket without credentials or peer verification. Attackers who bind the daemon port before it starts or after it exits receive the extension's full tool surface, including evaluate, to run JavaScript through CDP in logged-in browser tabs."}],"metrics":[{"cvssV4_0":{"attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","baseScore":7.2,"baseSeverity":"HIGH","privilegesRequired":"LOW","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-923","description":"Improper Restriction of Communication Channel to Intended Endpoints","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-09T23:27:34.958Z","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck"},"references":[{"name":"GitHub Issue #402","tags":["issue-tracking"],"url":"https://github.com/Tencent/BrowserSkill/issues/402"},{"tags":["product"],"url":"https://github.com/Tencent/BrowserSkill"},{"tags":["technical-description"],"url":"https://github.com/Tencent/BrowserSkill/blob/ext-v0.4.2/apps/extension/src/transport/remote-endpoint.ts#L79-L85"},{"tags":["patch"],"url":"https://github.com/Tencent/BrowserSkill/commit/7e862a44d19d0c1e492901fe29562cc7d79af590"},{"name":"VulnCheck Advisory: Tencent BrowserSkill through 0.4.2 Missing Authentication in Local WebSocket Transport","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/tencent-browserskill-through-0.4.2-missing-authentication-in-local-websocket-transport"}],"title":"Tencent BrowserSkill through 0.4.2 Missing Authentication in Local WebSocket Transport","x_generator":{"engine":"vulncheck-endgame"}}},"cveMetadata":{"assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","assignerShortName":"VulnCheck","cveId":"CVE-2026-125361","datePublished":"2026-11-09T23:27:34.958Z","dateReserved":"2026-11-09T22:03:00.581Z","dateUpdated":"2026-11-09T23:27:34.958Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-10 00:17:07","lastModifiedDate":"2026-11-10 00:17:07","problem_types":["CWE-923","CWE-923 Improper Restriction of Communication Channel to Intended Endpoints"],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1,"impactScore":5.2}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"125361","Ordinal":"1","Title":"Tencent BrowserSkill through 0.4.2 Missing Authentication in Loc","CVE":"CVE-2026-125361","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"125361","Ordinal":"1","NoteData":"Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to impersonate the bsk daemon because remoteSocket() connects to the loopback WebSocket without credentials or peer verification. Attackers who bind the daemon port before it starts or after it exits receive the extension's full tool surface, including evaluate, to run JavaScript through CDP in logged-in browser tabs.","Type":"Description","Title":"Tencent BrowserSkill through 0.4.2 Missing Authentication in Loc"}]}}}