MEDIUMCVSS v3.1 6.3Vulnerability
CVE-2026-125361
Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to impersonate the bsk daemon because remoteSocket() connects to the loopback WebSocket without credentials or peer verification. Attackers who bind the daemon port before it starts or after it exits receive the extension's full tool surface, including evaluate, to run JavaScript through CDP in logged-in browser tabs.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-10T23:33:48.924589+00:00
- Epss score
- 0.00121
- Cvss score
- 6.3
- Cvss severity
- MEDIUM
- Retrieved at
- 2026-11-10T23:35:17+00:00
- Score
- 6.3
- Last source
- FIRST EPSS
- Cvss version
- 3.1
- Cve id
- CVE-2026-125361
- Cvss vector
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
- First seen by Signal
- 2026-11-10T03:20:43+00:00
- Vector
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
- Published at
- 2026-11-10T00:17:07.717
- Last modified
- 2026-11-10T00:17:07.717
- Epss percentile
- 0.01914
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph