Medium severity6.6NVD Advisory· Published Sep 20, 2026· Updated Sep 22, 2026
CVE-2026-94111
CVE-2026-94111
Description
Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that accepts any chrome-extension origin with 32 characters in range a-p. Attackers can register a malicious extension as a browser client to intercept and manipulate page content, DOM, and screenshots returned to the AI agent.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <=0.3.0
Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.