Drxyj-01

**Name of the Vulnerable Software and Affected Versions** ByteDance Coze Scraper Extension versions prior to 2.0.3 **Description** An issue exists in the External Message Handler component within the `static/background/index.js` file. The `chrome.runtime.onMessageExternal.addListener()` function fails to properly authorize requests, allowing remote attackers to bypass authorization by manipulating the `body.url`, `paginationConfig`, `xPathConfig`, `body.urls`, or `xPaths` arguments. **Recommendations** Update ByteDance Coze Scraper Extension to a version newer than 2.0.2. As a temporary mitigation, restrict the use of the `chrome.runtime.onMessageExternal.addListener()` function in the `static/background/index.js` file.