Log in Start free

Vulnerability · Published Sep 23, 2026 · Assigned by VulDB

CVE-2026-96680ByteDance Coze Scraper Extension External Message index.js chrome.runtime.onMessageExternal.addListener authorization

Medium 4.3

In plain English

A medium-severity missing authorization in Coze Scraper Extension from ByteDance. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.4%top 61.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in ByteDance Coze Scraper Extension up to 2.0.2. Affected by this vulnerability is the function chrome.runtime.onMessageExternal.addListener of the file static/background/index.js of the component External Message Handler. The manipulation of the argument body.url/paginationConfig/xPathConfig/body.urls/xPaths results in missing authorization. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

VendorProductVersions
ByteDance Coze Scraper Extension 2.0.02.0.12.0.2

Weakness: CWE-862, CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

References