CVE-2026-96680

Executive Summary

CVE-2026-96680 is a missing authorization vulnerability (CWE-862) in the ByteDance Coze Scraper browser extension up to and including version 2.0.2, residing in the external message handler of static/background/index.js. The flaw allows a remote attacker, whose page must induce a victim to load it, to invoke privileged extension functionality via crafted chrome.runtime.onMessageExternal messages that manipulate arguments such as body.url, body.urls, paginationConfig, xPathConfig, and xPaths without an authorization check. Impact is limited to low-confidentiality disclosure (CVSS 4.3, C:L, no integrity or availability effect), but a public exploit exists and the vendor did not respond, so the issue remains unpatched.

Technical Analysis

The affected component is an "External Message Handler" implemented via chrome.runtime.onMessageExternal.addListener inside static/background/index.js. In the Chrome extension model, onMessageExternal is the API surface used by web pages or other extensions to send messages to a given extension from outside its own privileged context. Because the extension exposes this listener, external message senders can reach extension-internal logic depending on how the sender origin is validated inside the handler.

CVE-2026-96680 is classified as CWE-862 (Missing Authorization). The NVD description states that manipulation of the arguments body.url, paginationConfig, xPathConfig, body.urls, and xPaths results in missing authorization. These argument names indicate that the scraper's configuration surface — target URLs, pagination parameters, and XPath selectors — is controllable through the external message interface. The absent authorization check means the handler does not verify that the calling origin or caller identity is entitled to invoke the scraper, nor that the supplied URL/pagination/XPath configuration is permitted.

The vulnerable logic is reachable remotely (network attack vector) and requires the listing of externally_connectable origins in the manifest for the extension, meaning the attack surface is any web origin permitted to send messages to the extension. No integrity or availability impact is recorded; the CVSS subscores assign only low confidentiality impact (C:L). The attack additionally requires user interaction (UI:R), consistent with a victim needing to visit or interact with a malicious page that initiates the external message. The vulnerability is unpatched: the vendor was contacted early, did not respond, and no patch source is available. It is not in CISA KEV, has no CVSS/EPSS from FIRST.org beyond the stated 4.3 base score, and no Nuclei/OSV package data exists.

Exploitation Scenarios

No public PoC code is available; the attack chain below is inferred strictly from the vulnerability class (CWE-862 missing authorization on an external message handler) and the argument names disclosed in the description.

1. Reconnaissance / target identification. The attacker identifies a victim user who has the ByteDance Coze Scraper extension (<= 2.0.2) installed and determines whether the extension is externally messageable. Because an exploit is already public per the NVD description, an attacker can reuse known trigger logic rather than developing it.

2. Triggering the flaw class. The attacker hosts or compromises a web page whose origin is permitted to send messages to the extension. When the victim loads the page, the page sends a crafted external message to the extension targeting the chrome.runtime.onMessageExternal listener. The handler processes the message because it lacks an authorization check on the caller; the attacker-supplied message carries manipulated arguments in the body.url / body.urls, paginationConfig, xPathConfig, and xPaths family.

3. Payload/execution at the vulnerability-class level. Via the crafted message, the attacker influences the scraper's target URLs and extraction configuration. The absence of authorization means unauthorized callers can drive the scraper's request/fetch and parsing behavior with attacker-chosen inputs. The precise internal effect cannot be stated beyond this, because the NVD description does not disclose response or data-handling details.

4. Post-exploitation impact. Given the CVSS subscores (only C:L, no I, no A), the realistic outcome is unauthorized access to a limited set of scraped/collected information, for example data obtained by steering the extension's scraping toward attacker-selected resources. No tampering or service disruption is attributable under this vector.

Impact Assessment

The CVSS 3.1 base score is 4.3 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. Interpretation:

• AV:N — reachable over the network (a web page / external message sender), no local access required.
• AC:L — no unusual preconditions for the flaw itself; exploitation is straightforward.
• PR:N — no privileges required of the attacker.
• UI:R — the victim must interact with/load the attacker-controlled page that sends the external message.
• S:U — impact stays within the extension's security scope; no privilege boundary crossing to the host OS or browser.
• C:L / I:N / A:N — limited confidentiality loss only; no integrity or availability impact.

For an enterprise, the blast radius covers managed endpoints where Chrome/Chromium-based browsers have the Coze Scraper extension installed. The practical business impact is a low-severity data exposure: potentially leaked scrape results or configuration-driven data the extension can access, without modification of system state. The presence of a public exploit and the vendor's refusal to respond raise the operational risk relative to the nominal 4.3 score, particularly because no fix is forthcoming.

Detection Guidance

Sigma Rule

title: ByteDance Coze Scraper Extension External Message Abuse (CVE-2026-96680)
id: 8f3c1a52-7e4b-4d9e-b7a1-3c5e9d2f6a10
status: experimental
description: Detects Chrome extension external message handling activity associated with the Coze Scraper extension and use of scraper configuration parameters in messages.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-96680
author: valtersit.com
date: 2026-01-01
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains: 'static/background/index.js'
  selection_ext:
    TargetFilename|contains: 'chrome.runtime.onMessageExternal'
  condition: selection_path or selection_ext
falsepositives:
  - Legitimate extension updates or developer testing
level: low
tags:
  - attack.t1190
  - cve.2026.96680

YARA Rule

rule EXPL_CVE_2026_96680_Coze_Scraper_External_Message
{
    meta:
        description = "Detects Coze Scraper extension background script patterns related to CVE-2026-96680 external message handler"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-96680"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $a = "chrome.runtime.onMessageExternal" ascii wide
        $b = "onMessageExternal.addListener" ascii wide
        $c = "paginationConfig" ascii wide
        $d = "xPathConfig" ascii wide
        $e = "background/index.js" ascii wide

    condition:
        (uint16(0) == 0x4B50 or true) and
        ( ($a and $b) or ($c and $d) or ($e and ($c or $d)) )
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-96680 ByteDance Coze Scraper External Message Configuration Abuse"; flow:established,to_server; content:"paginationConfig"; http_client_body; nocase; content:"xPathConfig"; http_client_body; nocase; distance:0; classtype:attempted-recon; reference:cve,2026-96680; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-96680; sid:2026966801; rev:1;)

Elastic Detection

process where event.type == "start" and process.command_line : ("*onMessageExternal*" or "*paginationConfig*" or "*xPathConfig*") and process.command_line : ("*coze*" or "*scraper*" or "*background/index.js*")

Splunk SPL Query

index=main (sourcetype=*:web:* OR sourcetype=*:http:*)
| search (uri_query="*paginationConfig*" OR uri_query="*xPathConfig*" OR uri_query="*body.urls*" OR uri_query="*xPaths*")
| stats count min(_time) as first_seen max(_time) as last_seen values(dest) as dest values(src) as src by src_ip, uri_query
| where count > 0

Wazuh OSSEC Rule

<group name="web,attack,cve-2026-96680,">
  <rule id="100680" level="7">
    <decoded_as>json</decoded_as>
    <field name="uri_query">paginationConfig|paginationconfig</field>
    <description>CVE-2026-96680: Possible Coze Scraper external message configuration abuse (paginationConfig)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="100681" level="7">
    <decoded_as>json</decoded_as>
    <field name="uri_query">xPathConfig|xpathconfig</field>
    <description>CVE-2026-96680: Possible Coze Scraper external message XPath configuration abuse (xPathConfig)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Remove or disable the ByteDance Coze Scraper extension (<= 2.0.2) on managed browsers until a vendor fix is available.
   • If the extension must remain for business reasons, restrict browser extension installation via Chrome enterprise policy (ExtensionInstallForcelist / ExtensionInstallBlocklist) and tighten externally_connectable allow-lists where policy permits.
   • Treat the extension as untrusted and refrain from visiting untrusted web pages in the same browser profile where the extension is installed (the public exploit requires only that a victim load an attacker page).
   • Monitor browser network activity from endpoints for the disclosed configuration parameter names to identify attempted exploitation.

2. Patch/upgrade steps

   • No vendor patch exists. The vendor (ByteDance) was contacted early and did not respond in any way, and no CNA/NVD, OSV, or vendor advisory records a fixed version. Do not expect a rapid fix; plan for extension removal as the remediation path. Re-evaluate if a version above 2.0.2 is released and validated to add an authorization check on the external message handler.

3. Long-term hardening

   • Enforce least privilege on browser extensions across the fleet and maintain an approved-extension inventory.
   • Adopt a policy that only signed, actively maintained extensions with defined external-message authorization are permitted in managed profiles.
   • Centralize and retain browser/extension logs for detection of external-message abuse patterns.
   • Establish a process to track vendor non-response and escalate to CISA/vendor-coordination channels for unpatched, exploited issues.

References

• NVD — CVE-2026-96680: https://nvd.nist.gov/vuln/detail/CVE-2026-96680
• CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• CVSS 3.1 Specification: https://www.first.org/cvss/v3.1/specification-document
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-96680 NOT listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Note on exploit evidence: The NVD description states the exploit is now public and may be used. No CVE-specific threat actor campaign attribution, CISA KEV entry, or vendor advisory was available in the provided data. EPSS has not been scored by FIRST.org and no value is asserted here.