CVE-2026-94111: Tencent Browserskill

Medium severity, CVSS 6.6. EPSS: 0.1% chance of exploitation in the next 30 days.

Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that accepts any chrome-extension origin with 32 characters in range a-p. Attackers can register a malicious extension as a browser client to intercept and manipulate page content, DOM, and screenshots returned to the AI agent.

Affected products

• Tencent Browserskill: up to and including 0.3.0

Published 2026-09-20. Last modified 2026-09-22.