🚨 CVE-2026-86185
Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed in the renderer with access to the privileged IPC bridge, and execute system commands or steal login credentials.
🎖@cveNotify
Bilibili
哔哩哔哩下载中心
哔哩哔哩APP下载,哔哩哔哩PC客户端下载
September 5, 2026 58
