{"id":"CVE-2026-125361","kind":"vulnerability","aliases":["CVE-2026-125361"],"related":[],"title":"Tencent BrowserSkill: local attacker impersonates daemon and runs JavaScript in browser tabs","description":"Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to impersonate the bsk daemon because remoteSocket() connects to the loopback WebSocket without credentials or peer verification. Attackers who bind the daemon port before it starts or after it exits receive the extension's full tool surface, including evaluate, to run JavaScript through CDP in logged-in browser tabs.","summary":"Tencent BrowserSkill through 0.4.2 connects to a loopback WebSocket without credentials or peer verification, so a local process can pose as the bsk daemon. The attacker then receives the extension's full tool surface, including evaluate, which runs JavaScript through CDP in logged-in browser tabs.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"BrowserSkill","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ai-agents","ai-tooling","browserskill","cdp","local-dev"],"not_affected_if":["not-installed","version-above-0.4.2"],"how_to_check":"- Check whether BrowserSkill is installed and which version is present, for example by reading its package manifest or the installed extension's version.\n- Look for a `bsk` daemon listening on a loopback WebSocket port on developer machines and servers that run the tool.","fix":"- Move to a BrowserSkill release later than `0.4.2`; the sources do not name the fixed version in the product ranges.","status":"open","published_at":"2026-11-10T00:17:07+00:00","first_seen_at":"2026-11-10T00:28:42+00:00","triaged_at":"2026-11-10T00:30:06+00:00","updated_at":"2026-11-10T00:30:06+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-11-10T00:30:06Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a BrowserSkill release later than `0.4.2`; the sources do not name the fixed version in the product ranges.","reach":"local","title":"Tencent BrowserSkill: local attacker impersonates daemon and runs JavaScript in browser tabs","impact":"high","summary":"Tencent BrowserSkill through 0.4.2 connects to a loopback WebSocket without credentials or peer verification, so a local process can pose as the bsk daemon. The attacker then receives the extension's full tool surface, including evaluate, which runs JavaScript through CDP in logged-in browser tabs.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["browserskill","cdp","local-dev","ai-agents"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"local attacker runs JavaScript in logged-in browser tabs","analyst_note":"Confirm the fixed version from the github.com patch link and the vulncheck advisory; the sources do not state it.","how_to_check":"- Check whether BrowserSkill is installed and which version is present, for example by reading its package manifest or the installed extension's version.\n- Look for a `bsk` daemon listening on a loopback WebSocket port on developer machines and servers that run the tool.","plain_action":"","product_name":"BrowserSkill","needs_analyst":true,"not_affected_if":["not-installed","version-above-0.4.2"],"who_is_affected":"Anyone running Tencent BrowserSkill through 0.4.2 on a machine where other local users or processes can run code. The flaw needs a local attacker who binds the daemon port before or after the real daemon runs. Machines without BrowserSkill installed are not affected.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000789,"input_tokens":4632,"output_tokens":652,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125361':15A,18A '-2026':14A,17A '0.4.2':34B,81C 'agent':22B 'ai':21B,24B 'ai-ag':20B 'ai-tool':23B 'allow':88C 'attack':4A,56B,90C,108C 'authent':85C 'bind':110C 'browser':11A,76B,139C 'browserskil':2A,26B,32B,79C 'browserskill':19A 'bsk':53B,94C 'cdp':27B,71B,134C 'connect':35B,98C 'contain':82C 'credenti':41B,104C 'cve':13A,16A 'daemon':6A,54B,95C,112C 'dev':30B 'evalu':66B,129C 'exit':120C 'extens':60B,123C 'full':62B,125C 'imperson':5A,92C 'includ':65B,128C 'javascript':9A,69B,132C 'local':3A,29B,47B,89C 'local-dev':28B 'log':74B,137C 'logged-in':73B,136C 'loopback':38B,101C 'miss':84C 'peer':43B,106C 'port':113C 'pose':50B 'process':48B 'receiv':58B,121C 'remotesocket':97C 'run':8A,68B,131C 'start':116C 'surfac':64B,127C 'tab':12A,77B,140C 'tencent':1A,31B,78C 'tool':25B,63B,126C 'verif':44B,107C 'vulner':86C 'websocket':39B,102C 'without':40B,103C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Tencent BrowserSkill through 0.4.2 on a machine where other local users or processes can run code. The flaw needs a local attacker who binds the daemon port before or after the real daemon runs. Machines without BrowserSkill installed are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["browserskill"],"ptokens":["browserskill"],"labels":["aiagents","aitooling","browserskill","cdp","high","localdev","vendor"],"campaign_type":null,"search_a":"'-125361':15A,18A '-2026':14A,17A 'attack':4A 'browser':11A 'browserskil':2A 'browserskill':19A 'cve':13A,16A 'daemon':6A 'imperson':5A 'javascript':9A 'local':3A 'run':8A 'tab':12A 'tencent':1A","search_b":"'0.4.2':34B 'agent':22B 'ai':21B,24B 'ai-ag':20B 'ai-tool':23B 'attack':56B 'browser':76B 'browserskil':26B,32B 'bsk':53B 'cdp':27B,71B 'connect':35B 'credenti':41B 'daemon':54B 'dev':30B 'evalu':66B 'extens':60B 'full':62B 'includ':65B 'javascript':69B 'local':29B,47B 'local-dev':28B 'log':74B 'logged-in':73B 'loopback':38B 'peer':43B 'pose':50B 'process':48B 'receiv':58B 'run':68B 'surfac':64B 'tab':77B 'tencent':31B 'tool':25B,63B 'verif':44B 'websocket':39B 'without':40B","search_c":"'0.4.2':81C 'allow':88C 'attack':90C,108C 'authent':85C 'bind':110C 'browser':139C 'browserskil':79C 'bsk':94C 'cdp':134C 'connect':98C 'contain':82C 'credenti':104C 'daemon':95C,112C 'evalu':129C 'exit':120C 'extens':123C 'full':125C 'imperson':92C 'includ':128C 'javascript':132C 'local':89C 'log':137C 'logged-in':136C 'loopback':101C 'miss':84C 'peer':106C 'port':113C 'receiv':121C 'remotesocket':97C 'run':131C 'start':116C 'surfac':127C 'tab':140C 'tencent':78C 'tool':126C 'verif':107C 'vulner':86C 'websocket':102C 'without':103C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T00:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125361","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125361","severity":null,"published_at":"2026-11-10T00:17:07+00:00","modified_at":"2026-11-10T00:17:07+00:00","first_seen_at":"2026-11-10T00:28:42+00:00","fetched_at":"2026-11-10T00:28:42+00:00","note":null}],"documents":[{"id":111500,"url":"https://github.com/Tencent/BrowserSkill/commit/7e862a44d19d0c1e492901fe29562cc7d79af590","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111501,"url":"https://www.vulncheck.com/advisories/tencent-browserskill-through-0.4.2-missing-authentication-in-local-websocket-transport","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}