CVE-2026-96680mediumCWE-862CWE-863

CVE-2026-96680: medium-severity vulnerability in ByteDance Coze Scraper Extension

ByteDance Coze Scraper Extension External Message index.js chrome.runtime.onMessageExternal.addListener authorization

Published · Updated

Follow this CVE+ Monitor Coze Scraper Extension

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.3epss 0.4%
A vulnerability was detected in ByteDance Coze Scraper Extension up to 2.0.2. Affected by this vulnerability is the function chrome.runtime.onMessageExternal.addListener of the file static/background/index.js of the component External Message Handler. The manipulation of the argument body.url/paginationConfig/xPathConfig/body.urls/xPaths results in missing authorization. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
ByteDance · Coze Scraper Extension
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.