medium6.6
CVE-2026-94111
Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that accepts any chrome-exte…
Impact
Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that accepts any chrome-extension origin with 32 characters in range a-p. Attackers can register a malicious extension as a browser client to intercept and manipulate page content, DOM, and screenshots returned to the AI agent.
Affected products
| Product | Affected versions |
|---|---|
| Tencent BrowserSkill | through 0.3.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.