CVE-2026-94111

Name of the Vulnerable Software and Affected Versions Tencent BrowserSkill versions prior to 0.3.1

Description An authentication bypass exists in the local daemon WebSocket origin validation. The system incorrectly accepts any chrome-extension origin consisting of 32 characters within the range a-p. This allows an attacker to register a malicious extension as a browser client to intercept and manipulate page content, the Document Object Model (DOM), and screenshots returned to the AI agent.

Recommendations Update Tencent BrowserSkill to a version newer than 0.3.0.