The vulnerability affects the ByteDance Coze Scraper Extension up to version 2.0.2 in the External Message Handler's chrome.runtime.onMessageExternal.addListener function located in static/background/index.js. Manipulation of arguments such as body.url, paginationConfig, xPathConfig, body.urls, and xPaths leads to missing authorization, enabling remote exploitation. The vendor was notified but did not respond, and no patch or official fix is currently available. The CVSS 4.0 score is 5.3 (medium severity) with network attack vector, low complexity, no privileges required, user interaction required, and low impact on confidentiality.

An attacker can remotely exploit this vulnerability to bypass authorization checks in the extension, potentially allowing unauthorized access or actions via manipulated external messages. The impact on confidentiality is low, and there is no impact on integrity or availability reported. The exploit is public, increasing the risk of exploitation.

No official fix or patch is currently available from the vendor, and the vendor has not responded to disclosure attempts. Users should exercise caution when using affected versions 2.0.0, 2.0.1, and 2.0.2 of the Coze Scraper Extension. Consider disabling or removing the extension until a vendor update or patch is released. Monitor vendor channels for any future advisories or patches.