Tencent BrowserSkill WebSocket Origin Validation Bypass

Technical Analysis

The vulnerability lies in the origin validation logic of BrowserSkill's local daemon WebSocket server, which is meant to restrict connections to a specific trusted browser extension. Because the check only validates that the origin is a chrome-extension:// URL with a 32-character ID composed of letters a-p (a pattern satisfied by any arbitrarily-generated extension ID within that charset), an attacker can install and register a rogue extension that passes validation. Once connected as a trusted client, the malicious extension can intercept, modify, or fabricate DOM content, page text, and screenshots before they reach the AI agent, enabling a form of local man-in-the-middle attack against the agent's perception layer. This crosses the boundary between browser-extension sandboxing and the agent's trust model, since the agent treats data received over this channel as authoritative ground truth about the browsed page, and manipulated content can be used to steer agent decisions, exfiltrate sensitive on-page data, or inject further instructions into agent context.

Affected Systems

Tencent BrowserSkill; protocols: WebSocket

Detection Signatures

• Unexpected chrome-extension:// origins connecting to local daemon WebSocket port
• Multiple or unrecognized extension IDs authenticating against BrowserSkill daemon
• WebSocket connection logs showing origin values matching pattern of 32 chars restricted to a-p without additional identity verification
• Discrepancies between rendered page content/screenshots and expected DOM state
• Unusual or newly-installed browser extensions requesting local WebSocket/native messaging permissions

Remediation Steps

1. 1

   Upgrade BrowserSkill

   Update to a patched version beyond 0.3.0 once Tencent releases a fix that enforces exact extension ID matching or cryptographic client authentication.

2. 2

   Restrict extension installation

   Use enterprise policy to allowlist only the specific vetted BrowserSkill extension ID and block installation of unknown or sideloaded extensions.

3. 3

   Bind daemon to strict authentication

   Implement token-based or mutual authentication between the daemon and extension rather than relying solely on origin header validation.

4. 4

   Monitor local WebSocket connections

   Log and alert on all connections to the local agent daemon, flagging any origin not matching the exact known-good extension ID.

5. 5

   Validate agent input provenance

   Have the AI agent treat browser-derived content as untrusted input and apply integrity checks or sanitization before acting on DOM/screenshot data.