CVE-2026-94111: Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin

Tencent BrowserSkill up to version 0.3.0 has a security flaw in its local daemon's WebSocket origin validation (the process that checks if a connection request is from a legitimate source). Attackers can create a fake browser extension that appears legitimate and use it to intercept and alter the page content, DOM (the structure of web page elements), and screenshots that the AI agent receives.