CVE-2026-125361 Tencent BrowserSkill through 0.4.2 Missing Authentication in Local WebSocket Transport
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-125361?
CVE-2026-125361 is a high-severity vulnerability in Tencent BrowserSkill, published on 9 Nov 2026.
Official description
Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to impersonate the bsk daemon because remoteSocket() connects to the loopback WebSocket without credentials or peer verification. Attackers who bind the daemon port before it starts or after it exits receive the extension's full tool surface, including evaluate, to run JavaScript through CDP in logged-in browser tabs.
Weakness: CWE-923
Which versions are affected by CVE-2026-125361?
How do I fix CVE-2026-125361?
No fix has been published for CVE-2026-125361 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-125361 being exploited?
There is no known exploitation of CVE-2026-125361 in the wild and no public exploit code.
Sources
Also known as GHSA-5pfr-frx5-hqwp.