CVE-2026-96680: ByteDance Coze Scraper Auth Bypass Flaw

CVE-2026-96680 Overview

CVE-2026-96680 is a missing authorization vulnerability [CWE-862] in the ByteDance Coze Scraper Chrome extension through version 2.0.2. The flaw resides in the chrome.runtime.onMessageExternal.addListener function within static/background/index.js, part of the External Message Handler component. The listener accepts messages from external web pages without verifying the sender. Attackers can manipulate the body.url, paginationConfig, xPathConfig, body.urls, and xPaths arguments to trigger arbitrary URL scraping through the extension's privileged context. Public exploit code is available. According to VulDB, the vendor was contacted but did not respond to the disclosure.

Critical Impact
Any website a user visits can invoke the extension's scraping capabilities to fetch arbitrary URLs, exposing content the browser has access to and abusing the extension as a scraping proxy.

Affected Products

ByteDance Coze Scraper Chrome Extension version 2.0.0
ByteDance Coze Scraper Chrome Extension version 2.0.1
ByteDance Coze Scraper Chrome Extension version 2.0.2

Discovery Timeline

2026-09-23 - CVE-2026-96680 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-96680

Vulnerability Analysis

The Coze Scraper extension registers an external message listener that any web page can invoke through chrome.runtime.sendMessage. The handler processes scraping requests without validating the origin of the sender. Attacker-controlled web pages can therefore instruct the extension to scrape arbitrary URLs and return the results, using the extension's host permissions rather than the page's own fetch context. Because the extension operates with elevated browser privileges, this bypasses same-origin protections that would normally block cross-origin content retrieval from a scripted page.

Root Cause

The root cause is a missing authorization check [CWE-862] inside chrome.runtime.onMessageExternal.addListener in static/background/index.js. The listener does not enforce an allowlist of externally_connectable origins and does not validate the sender object before acting on the body.url, body.urls, paginationConfig, xPathConfig, and xPaths fields. Any origin able to reach the extension ID can supply these parameters.

Attack Vector

Exploitation requires a user to visit a malicious or compromised web page while the vulnerable extension is installed. The page sends a crafted external message referencing the extension ID and includes attacker-chosen body.url or body.urls values along with the XPath configuration. The extension's background service worker fulfills the scraping request and can return the harvested content to the sender. The attack is remote and requires only passive user interaction with the page.

For exploitation mechanics, see the GitHub PoC repository and the VulDB entry for CVE-2026-96680.

Detection Methods for CVE-2026-96680

Indicators of Compromise

Outbound HTTP requests originating from the Chrome extension process to URLs unrelated to normal user browsing activity.
Unexpected chrome.runtime.sendMessage calls in page scripts targeting the Coze Scraper extension ID.
Presence of Coze Scraper extension versions 2.0.0 through 2.0.2 in managed browser inventories.

Detection Strategies

Enumerate installed Chrome extensions across the fleet and flag Coze Scraper versions at or below 2.0.2.
Inspect browser process network telemetry for scraping patterns sourced from extension contexts rather than user tabs.
Review web application logs for repeated GET requests carrying browser extension user-agent characteristics against unrelated third-party hosts.

Monitoring Recommendations

Enable Chrome enterprise policy reporting to centralize extension inventory and version data.
Alert on new extension installations that request <all_urls> host permissions or declare externally_connectable manifests.
Correlate DNS and proxy logs with browser extension telemetry to identify anomalous fetch activity.

How to Mitigate CVE-2026-96680

Immediate Actions Required

Uninstall or disable the Coze Scraper extension on all managed browsers until the vendor issues a fix.
Block the extension ID through Chrome enterprise policy using ExtensionInstallBlocklist.
Restrict installation of unreviewed Chrome extensions using ExtensionInstallAllowlist on managed endpoints.

Patch Information

No vendor patch is available. VulDB reports that ByteDance did not respond to disclosure attempts. Track the VulDB advisory for status changes and remove the extension until an updated release addresses the missing authorization check.

Workarounds

Enforce a Chrome extension allowlist that excludes Coze Scraper across managed devices.
Deploy content security policies on internal web applications to reduce the value of arbitrary scraping against sensitive endpoints.
Educate users to avoid sideloading browser extensions from untrusted sources and to remove unused extensions.

bash

# Chrome enterprise policy example to block the affected extension
# Replace EXTENSION_ID with the Coze Scraper extension identifier
{
  "ExtensionInstallBlocklist": ["EXTENSION_ID"],
  "ExtensionInstallForcelist": []
}