CVE-2026-96680 Details
Description
A vulnerability was detected in ByteDance Coze Scraper Extension up to 2.0.2. Affected by this vulnerability is the function chrome.runtime.onMessageExternal.addListener of the file static/background/index.js of the component External Message Handler. The manipulation of the argument body.url/paginationConfig/xPathConfig/body.urls/xPaths results in missing authorization. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability exists in the ByteDance Coze Scraper Chrome extension, specifically in version 2.0.2. The issue arises in the External Message Handler component, where the function 'chrome.runtime.onMessageExternal.addListener' fails to properly validate the origin of messages. This oversight allows remote websites to send commands that the extension will execute, such as scraping specified URLs. The vulnerability is exacerbated by the extension's configuration, which permits messages from any HTTP or HTTPS origin, creating a 'confused deputy' scenario. As a result, an attacker-controlled website can trigger the extension to access and scrape content from pages that the user can access, potentially including sensitive information or internal resources.
Users are advised to restrict the 'externally_connectable.matches' field in the extension manifest to trusted origins only. Additionally, implement validation of the sender's origin against an allowlist before processing external messages, and require explicit user consent before scraping URLs provided through external channels.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 23, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/xryj920/chrome_extensions/blob/main/Coze%20Scraper%202.0.2%20Unrestricted%20External%20Message%20Handler%20Allows%20Website-Triggered%20Arbitrary%20URL%20Scraping | [email protected] | ExploitTechnical Analysis |
| https://vuldb.com/cve/CVE-2026-96680 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/904123 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/409003 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/409003/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ByteDance Coze Scraper | 2.0.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 23, 2026 | New CVE Received | [email protected] |