CVE-2026-96680
ByteDance Coze Scraper Extension External Message index.js chrome.runtime.onMessageExternal.addListener authorization
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was detected in ByteDance Coze Scraper Extension up to 2.0.2. Affected by this vulnerability is the function chrome.runtime.onMessageExternal.addListener of the file static/background/index.js of the component External Message Handler. The manipulation of the argument body.url/paginationConfig/xPathConfig/body.urls/xPaths results in missing authorization. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
| CWE | CWE-862 CWE-863 |
| Vendor | bytedance |
| Product | coze scraper extension |
| Published | Sep 23, 2026 |
Stay Ahead of the Next One
Get instant alerts for bytedance coze scraper extension
Be the first to know when new medium vulnerabilities affecting bytedance coze scraper extension are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
ByteDance / Coze Scraper Extension
2.0.0 2.0.1 2.0.2
References
vuldb.com: https://vuldb.com/vuln/409003 vuldb.com: https://vuldb.com/vuln/409003/cti vuldb.com: https://vuldb.com/cve/CVE-2026-96680 vuldb.com: https://vuldb.com/submit/904123 github.com: https://github.com/xryj920/chrome_extensions/blob/main/Coze%20Scraper%202.0.2%20Unrestricted%20External%20Message%20Handler%20Allows%20Website-Triggered%20Arbitrary%20URL%20Scraping
Credits
🔍 DRXYJ-01 (VulDB User) VulDB CNA Team