Description
A vulnerability was detected in ByteDance Coze Scraper Extension up to 2.0.2. Affected by this vulnerability is the function chrome.runtime.onMessageExternal.addListener of the file static/background/index.js of the component External Message Handler. The manipulation of the argument body.url/paginationConfig/xPathConfig/body.urls/xPaths results in missing authorization. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-23
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Authorization bypass allowing arbitrary URL scraping via external messages
Action: Patch now
AI Analysis

Impact

ByteDance Coze Scraper Extension is vulnerable in its background script, where the chrome.runtime.onMessageExternal.addListener function processes message arguments—URL, pagination configuration, XPath expression—without verifying that the sender is authorized. The missing authorization check allows an attacker to supply arbitrary parameters, causing the extension to retrieve and store content from any target URL. This flaw is a missing authority enforcement weakness (CWE‑862) compounded by lack of parameter validation (CWE‑863).

Affected Systems

ByteDance Coze Scraper Extension, versions through 2.0.2, with no later release confirmed to contain the fix.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity vulnerability. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. A public exploit is available, and the vulnerability can be exploited remotely without requiring the user to install additional code or grant special permissions. Once triggered, the extension will collect data from the supplied URL, potentially exposing private or sensitive information to the attacker.

Generated by OpenCVE AI on September 24, 2026 at 01:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Coze Scraper Extension to any version that has addressed the missing authorization flaw; vendor notification has been attempted but a fix has not yet been released.
  • If no updated version is available, remove the extension from the browser to eliminate the attack surface.
  • As a provisional measure, modify the extension’s background script to filter external messages based on a whitelist of trusted origins, ensuring the listener only accepts messages from known, authorized sites.

Generated by OpenCVE AI on September 24, 2026 at 01:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 23 Sep 2026 23:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in ByteDance Coze Scraper Extension up to 2.0.2. Affected by this vulnerability is the function chrome.runtime.onMessageExternal.addListener of the file static/background/index.js of the component External Message Handler. The manipulation of the argument body.url/paginationConfig/xPathConfig/body.urls/xPaths results in missing authorization. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title ByteDance Coze Scraper Extension External Message index.js chrome.runtime.onMessageExternal.addListener authorization
First Time appeared Bytedance
Bytedance coze Scraper Extension
Weaknesses CWE-862
CWE-863
CPEs cpe:2.3:a:bytedance:coze_scraper_extension:*:*:*:*:*:*:*:*
Vendors & Products Bytedance
Bytedance coze Scraper Extension
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Bytedance Coze Scraper Extension
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-23T23:00:11.989Z

Reserved: 2026-09-23T15:38:11.433Z

Link: CVE-2026-96680

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-23T23:18:50.117

Modified: 2026-09-23T23:18:50.117

Link: CVE-2026-96680

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-24T01:30:12Z

Weaknesses