What happened
NVD published CVE-2026-94111 on 2026-09-20 (VulnCheck): the WebSocket origin validation in BrowserSkill's local daemon (crates/bsk-cli/src/daemon/ws.rs) accepts any chrome-extension origin with 32 characters in a-p, bypassing authentication for local browser clients. Affects versions through 0.3.0.
Why it matters
Browser-use/computer-use tools are the agent's eyes into the web. A spoofable daemon origin lets a co-resident malicious extension feed a browser-control AI agent fabricated or manipulated page state (classic indirect-modal attack on the agent's observation channel), tampering with the DOM and screenshots that drive the agent's decisions.
Attack vector
The local daemon validates WebSocket connections by accepting any chrome-extension origin with exactly 32 characters in the range a-p (a predictable spoofable pattern). A malicious browser extension registers as the browser client and can read/intercept the page content, DOM, and screenshots that are being returned to the AI agent, enabling data tampering of everything the browser-use agent observes.
Affected systems
Tencent BrowserSkill through 0.3.0 (npm browser-skill)
Mitigation
No patched release confirmed in the advisory; treat the local daemon as untrusted against co-installed extensions, restrict extension installs, and monitor the agent's browser observations. Advisory: https://www.vulncheck.com/advisories/tencent-browserskill-through-0.3.0-origin-validation-error-in-local-websocket-daemon