Description

Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that accepts any chrome-extension origin with 32 characters in range a-p. Attackers can register a malicious extension as a browser client to intercept and manipulate page content, DOM, and screenshots returned to the AI agent.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.6",
  "pubDate": "2026-09-20T12:17:06.787Z",
  "pubdate": "2026-09-20T12:17:06.787Z",
  "executiveSummary": "Tencent BrowserSkill versions 0.3.0 and earlier are affected by a critical authentication bypass vulnerability stemming from flawed WebSocket origin validation within the local daemon.\nThe vulnerability resides in the trust logic that governs incoming WebSocket connections, specifically regarding the verification of chrome-extension origins.\nAn attacker can exploit this by registering a malicious browser extension that matches the improperly validated origin pattern, effectively bypassing authentication protocols.\nSuccessful exploitation allows unauthorized entities to masquerade as legitimate clients, facilitating the interception and manipulation of sensitive data handled by the AI agent, including DOM structures, rendered page content, and visual screenshots.\nThis vulnerability poses a significant risk to user privacy and system integrity, as it grants an attacker complete control over the information stream between the web browser and the AI agent service.\nThe attack is localized to the machine hosting the daemon and does not require complex remote network access, but it necessitates the installation of a malicious extension on the victim's browser instance.",
  "technicalDetails": "The root cause of this vulnerability is an insecure implementation of origin verification logic in the local daemon component of Tencent BrowserSkill.\nDuring the WebSocket handshake process, the daemon performs an origin check to ensure that only authorized browser extensions can establish a command-and-control connection.\nThe validation logic utilizes a flawed pattern-matching routine that permits any 'chrome-extension://' origin string consisting of exactly 32 characters within the alphanumeric range of 'a' through 'p'.\nThis overly permissive regular expression or conditional check fails to verify the specific extension ID against a cryptographically signed or known-good allowlist.\nExploitation involves an attacker crafting a malicious browser extension with a unique ID that satisfies the 32-character 'a-p' constraint. Once installed, the extension can programmatically initiate a WebSocket connection to the local daemon, which the daemon incorrectly identifies as a trusted, authorized browser client.\nUpon successful connection, the malicious extension inherits the communication channel previously reserved for legitimate BrowserSkill interactions.\nThe attack flow proceeds as follows: First, the attacker facilitates the installation of the malicious extension (e.g., via social engineering or side-loading). Second, the extension identifies the local daemon's WebSocket endpoint. Third, the extension initiates the handshake; the daemon evaluates the origin, incorrectly validates the malicious ID, and establishes the persistent connection.\nOnce authenticated, the attacker gains the ability to perform 'man-in-the-middle' operations on the data stream. This includes injecting malicious scripts into the DOM, intercepting outgoing page data, and capturing screenshots intended for the AI agent’s analysis. The AI agent, trusting the integrity of the data provided by the daemon, subsequently processes the attacker-controlled information as if it originated from a legitimate browser session.\nThis vulnerability effectively circumvents the intended security boundaries of the local daemon, allowing unauthorized local processes to manipulate the interaction between the user's browser environment and the AI agent."
}