CVSS 4.0
6.9 mediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:NCVE-2026-94111
Medium (6.9). EPSS 0.1% chance of exploitation in the next 30 days.
Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that accepts any chrome-extension origin with 32 characters in range a-p. Attackers can register a malicious extension as a browser client to intercept and manipulate page content, DOM, and screenshots returned to the AI agent.
Severity
CVSS 3.1
6.6 mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L- EPSS
- 0.1% chance of exploitation in the next 30 days; higher than 2% of CVEs (scores of 2026-10-31)
- CWE
- CWE-346
- Published
- Modified
- Record from
- the NVD, synced