CVE-2026-94111

MediumCVSS 6.6/10Last modified Sep 22, 2026

Description

Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that accepts any chrome-extension origin with 32 characters in range a-p. Attackers can register a malicious extension as a browser client to intercept and manipulate page content, DOM, and screenshots returned to the AI agent.

Metrics

CVSS 3.1 6.6/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Weakness enumeration

CWE-346

Affected software

No affected versions have been published.

Timeline

Published: Sep 20, 2026
Last modified: Sep 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-941126.8mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acc CVE-2026-941136.5Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet end CVE-2026-941145.9Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating th CVE-2026-941158.5Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions.CVE-2026-941177.6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems HashBar – WordPress Notificat CVE-2026-941186.5Contributor Cross Site Scripting (XSS) in Premium Blocks – Gutenberg Blocks for WordPress <= 2.3.17 versions.CVE-2026-94126.3A vulnerability was determined in SourceCodester Indian Invoicing System 1.0. Impacted is an unknown function of the component Backend Endpo CVE-2026-941207.5Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.CVE-2026-941218.8Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.CVE-2026-941227.2Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.CVE-2026-941237.5Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.CVE-2026-941248.5Contributor SQL Injection in WP EasyCart <= 5.9.4 versions.