Threats tagged 'ghsa-5pfr-frx5-hqwp'

Tencent BrowserSkill versions through 0.4.2 have a missing authentication vulnerability that allows local attackers to impersonate the bsk daemon. This occurs because the remoteSocket() function connects to the loopback WebSocket without requiring credentials or verifying the peer. An attacker who binds the daemon port before it starts or after it exits can access the extension's full tool surface, including the ability to run JavaScript in logged-in browser tabs via the Chrome DevTools Protocol (CDP).