EUVD-2026-120524

Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to impersonate the bsk daemon because remoteSocket connects to the loopback WebSocket without credentials or peer verification. Attackers who bind the daemon port before it starts or aft...

CVE-2026-125361

Tencent BrowserSkill versions through 0.4.2 are affected by a missing authentication vulnerability. The root cause is that the remoteSocket() function connects to a loopback WebSocket without performing credential or peer verification . This allows a local attacker to impersonate the bsk daemon b...