CVE-2026-94111: BrowserSkill 0.3.0 Auth Bypass via WebSocket Origin Validation
CVE-2026-94111 Published on September 20, 2026

Tencent BrowserSkill through 0.3.0 Origin Validation Error in Local WebSocket Daemon
Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that accepts any chrome-extension origin with 32 characters in range a-p. Attackers can register a malicious extension as a browser client to intercept and manipulate page content, DOM, and screenshots returned to the AI agent.

NVD

Vulnerability Analysis

CVE-2026-94111 can be exploited with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.

Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE

Weakness Type

Origin Validation Error

The software does not properly verify that the source of data or communication is valid.


Affected Versions

Tencent BrowserSkill: