BrowserSkill WebSocket Daemon Insufficient Origin Validation Enables Session Hijacking via Malicious Extension

Vulnerability Summary Vulnerability Overview Title: Local WebSocket daemon accepts commands from any browser extension, not just BrowserSkill's own #273 Type: The local WebSocket daemon does not correctly validate the source, allowing any browser extension (not just BrowserSkill's own extension) to send commands. Core Issue: BrowserSkill's local daemon ( ) runs a WebSocket server (default port 52800) for the companion browser extension to connect to and control the AI agent. The daemon only validates connections by checking if the request header matches the prefix, without validating the specific extension ID. This means any extension in the same browser profile (including malicious or compromised ones) can connect to the daemon, thereby gaining control of the AI agent. Impact Scope Affected Versions: (commit , 2026-09-16), the latest available version at the time of reporting. Impact: - Other extensions in the same browser profile can drive the daemon, thereby: - Navigating pages, reading page content, and taking screenshots. - Submitting forms (e.g., login, banking, internal tools, etc.). - Gaining full control over the user session (equivalent to user operations). - This constitutes a browser session hijacking path that does not require installing other malware; it only requires installing a malicious extension on a machine where the BrowserSkill daemon is already running. - Critical Risks: 1. Session Spoofing: An attacker's extension can create its own session and have the daemon treat it as a "real" browser session, thereby taking over the user's ongoing tasks. 2. Denial of Service (DoS): An attacker's extension can register and occupy all session slots, preventing the legitimate extension from connecting. Remediation Status: Fixed Fix Details: 1. Extension ID Validation: In , the function was modified to strictly match a predefined list of legitimate extension IDs, rather than only checking for the prefix. 2. Code Changes: - Introduced a constant containing all legitimate extension IDs. - Modified the function to check if the extension ID in the header is present in the list. - Removed the old logic that only checked the prefix. Relevant Code Snippet (Post-Fix Context): (Note: The code above is the pre-fix version, illustrating the vulnerability that only checks the prefix and length. The post-fix code should include a whitelist check for specific extension IDs.) Verification: The fix was confirmed in (2026-09-18). Testing indicates that connections from non-whitelisted extensions are now rejected. Cross-session effects (such as or ) have protective mechanisms in place to prevent attacker extensions from interfering with legitimate sessions. POC / Exploitation Code A complete POC code was not provided in the page, but the exploitation method was described: An attacker only needs to install a custom extension in the target browser that contains a simple WebSocket client connecting to and sending commands compliant with the BrowserSkill protocol (such as or related instructions). Since the daemon does not validate the extension ID, commands from this malicious extension will be accepted and executed. Example Exploitation Concept (Not Complete Code): (Note: This is a conceptual example; actual protocol details should be referenced in the BrowserSkill documentation.)

Goal Reached Thanks to every supporter — we hit 100%!

BrowserSkill WebSocket Daemon Insufficient Origin Validation Enables Session Hijacking via Malicious Extension

More from this source