CVE-2026-94111: Tencent BrowserSkill Auth Bypass Vulnerability

CVE-2026-94111 Overview

CVE-2026-94111 is an authentication bypass vulnerability in Tencent BrowserSkill through version 0.3.0. The flaw resides in the local daemon's WebSocket origin validation logic, which accepts any chrome-extension origin containing 32 characters in the range a-p. Because the check verifies only the format of the extension identifier and not its authenticity, any locally installed extension matching the pattern can register as a legitimate browser client. An attacker who convinces a user to install a malicious extension can intercept and manipulate page content, Document Object Model (DOM) data, and screenshots returned to the AI agent. The weakness is tracked as [CWE-346] Origin Validation Error.

Critical Impact
A malicious Chrome extension can impersonate the trusted BrowserSkill client, feeding falsified browser data to the AI agent and corrupting its downstream decisions.

Affected Products

Tencent BrowserSkill CLI versions up to and including 0.3.0
BrowserSkill local daemon component (bsk-cli)
Integrations relying on the BrowserSkill WebSocket bridge for AI agent browser control

Discovery Timeline

2026-09-20 - CVE-2026-94111 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-94111

Vulnerability Analysis

BrowserSkill runs a local daemon that exposes a WebSocket endpoint on the loopback interface. Browser extensions connect to this endpoint to relay page content, DOM snapshots, and screenshots to an AI agent. To restrict which clients can connect, the daemon inspects the Origin header on incoming WebSocket handshakes.

The validation logic accepts any origin matching the chrome-extension:// scheme followed by a 32-character identifier drawn from the letters a through p. This pattern mirrors the Chrome extension ID format but performs no allowlist comparison against a known trusted extension ID. Any local extension that satisfies the syntactic pattern is treated as authorized.

Once connected, the impersonating extension participates as a full browser client. It can inject fabricated DOM data, replace screenshots, and manipulate content that the AI agent uses to make decisions or drive subsequent actions.

Root Cause

The root cause is a permissive origin check in the WebSocket handshake handler at crates/bsk-cli/src/daemon/ws.rs. The implementation validates the shape of the extension identifier but does not compare it against the expected BrowserSkill extension ID. This is a classic [CWE-346] origin validation error where structural conformance is mistaken for identity.

Attack Vector

Exploitation requires local access and a low-privileged foothold: the attacker must be able to install or coerce the installation of a Chrome extension on the victim's system. No user interaction with the AI agent is required once the extension is loaded. The malicious extension connects to the loopback WebSocket, passes the origin check, and begins servicing requests from the AI agent with attacker-controlled content.

Refer to the BrowserSkill WebSocket source and the VulnCheck advisory for the vulnerable code path.

// No verified proof-of-concept code is published for this issue.
// See the referenced advisories for technical detail.

Detection Methods for CVE-2026-94111

Indicators of Compromise

Unexpected Chrome extensions installed on hosts running the BrowserSkill CLI, particularly extensions with 32-character IDs limited to letters a-p.
Multiple concurrent WebSocket clients connected to the local BrowserSkill daemon when only one authorized extension should be present.
AI agent workflows returning DOM content or screenshots that do not match the actual page state observed by the user.

Detection Strategies

Enumerate installed browser extensions on developer workstations and compare against an approved list; flag any unknown extension connecting to the BrowserSkill daemon port.
Enable verbose logging on the BrowserSkill daemon to capture the Origin header and extension ID of every WebSocket handshake for review.
Correlate BrowserSkill agent output with independent browser telemetry to detect inconsistencies indicative of DOM or screenshot tampering.

Monitoring Recommendations

Monitor process and network telemetry for new listeners or connections on the BrowserSkill loopback WebSocket port.
Track Chrome extension installation events through endpoint telemetry and alert on unsigned or unmanaged extensions on hosts that run AI agent tooling.
Review AI agent decision logs for anomalies that could indicate manipulated browser context.

How to Mitigate CVE-2026-94111

Immediate Actions Required

Restrict use of Tencent BrowserSkill 0.3.0 and earlier on shared or multi-user systems until an updated release is available.
Audit Chrome extension inventories on all hosts running BrowserSkill and remove any extensions that are not explicitly required.
Enforce enterprise extension allowlists through Chrome policy to prevent installation of unapproved extensions.

Patch Information

At the time of publication, no vendor-fixed release is referenced in the NVD entry. Track the upstream BrowserSkill Issue #273 and the VulnCheck advisory for remediation status and apply the fixed version once released.

Workarounds

Configure Chrome enterprise policy ExtensionInstallAllowlist to permit only the authentic BrowserSkill extension ID, blocking rogue extensions from being loaded.
Bind the BrowserSkill daemon strictly to 127.0.0.1 and require an out-of-band shared secret or token during the WebSocket handshake in addition to origin checks.
Run BrowserSkill inside a dedicated user profile or sandboxed browser instance that contains no third-party extensions.

bash

# Example Chrome enterprise policy restricting extensions to an approved ID
# /etc/opt/chrome/policies/managed/browserskill_allowlist.json
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "<authentic-browserskill-extension-id>"
  ]
}