Description

Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed in the renderer with access to the privileged IPC bridge, and execute system commands or steal login credentials.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.0",
  "pubDate": "2026-09-05T12:16:49.240Z",
  "pubdate": "2026-09-05T12:16:49.240Z",
  "executiveSummary": "Bilibili Desktop through 1.18.0 suffers from critical security deficiencies in its configuration update mechanism, specifically the lack of TLS certificate verification and absent integrity checks for remote JavaScript payloads.\nThese vulnerabilities enable a Man-in-the-Middle (MitM) attacker to intercept and modify configuration data, leading to arbitrary JavaScript injection within the application's renderer process.\nGiven that the renderer possesses access to a privileged Inter-Process Communication (IPC) bridge, successful exploitation allows for remote code execution on the underlying host system, potential theft of authentication credentials, and complete compromise of the client environment.\nThe attack requires an adversary to be positioned on the network path between the client and the configuration server, such as through ARP spoofing, DNS hijacking, or compromised network infrastructure.\nThe lack of cryptographic enforcement on update channels presents a severe risk, as the application effectively trusts any payload delivered to the client, negating the security model of the update process.",
  "technicalDetails": "The vulnerability originates from two fundamental flaws in the update and configuration retrieval architecture of Bilibili Desktop. First, the application disables TLS certificate verification globally for network requests related to configuration fetching. This programmatic choice allows any malicious party to present an arbitrary or self-signed certificate, facilitating a seamless interception of encrypted traffic without triggering browser or system security warnings.\nSecond, the application architecture fails to implement digital signature verification or cryptographic integrity checks (e.g., HMAC or SHA-256 hashing) on the fetched configuration files. These files contain JavaScript code that is subsequently executed in the context of the application's renderer process.\nThe exploitation flow proceeds as follows: 1. An attacker positioned on the network path intercepts the request for the configuration file. 2. Due to the lack of TLS validation, the attacker terminates the TLS connection and injects a malicious configuration file containing arbitrary JavaScript. 3. The Bilibili Desktop client retrieves this payload, failing to verify its origin or integrity. 4. The renderer process parses and executes the injected JavaScript code. 5. Leveraging the privileged IPC bridge—which is intended for internal application logic—the injected script issues commands to the main process.\nBecause the IPC bridge is exposed to the renderer, this breach facilitates an escalation from a compromised renderer context to arbitrary system command execution. An attacker can craft a payload to perform unauthorized operations, such as executing system-level shell commands, exfiltrating local data, or harvesting sensitive login session tokens stored by the application. This vulnerability persists through version 1.18.0 and represents a significant failure in secure design principles for desktop applications utilizing web-based rendering engines."
}