GeekezBrowser CVE-2026-120503

Requires a local approach (CVSS AV:L): the attacker must be able to reach GeekezBrowser's localhost HTTP Public API on the machine running the application. The affected part is the /api/status endpoint, which - per the vendor patch diff - previously set 'Access-Control-Allow-Origin: *' and performed no authorization check, so any local process (and potentially a web page issuing cross-origin requests to the localhost API) could read its status response. Limiting factors that reduce real-world risk: exploitation is local rather than remote, the disclosed data is low-sensitivity (CVSS VC:L, CWE-200), there is no integrity or availability impact, and installing version 1.8.1 - which adds bearer-token authentication to the local API - removes the exposure.

This is a low-to-moderate severity information-disclosure issue (CVSS 4.0 base 4.8) in GeekezBrowser's local Public API, and the signals converge on it being a genuine but non-urgent problem rather than a high-priority emergency. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:L) describes a local, low-complexity, low-confidentiality-impact flaw with no integrity or availability effect, and the E:P (Proof-of-Concept) exploit-maturity value matches the single reference-only PoC. There is no CISA KEV listing and no EPSS score supplied, so there is no evidence of active or widespread exploitation; the vuln.today decision label is 'this_month', consistent with a patch-soon-but-not-emergency posture. One conflict must be flagged: the input vector asserts PR:L (authenticated), but the vendor patch diff shows the pre-patch /api/status endpoint had NO authentication at all - it served responses with 'Access-Control-Allow-Origin: *' and no bearer token - which argues the flaw was actually reachable without credentials (PR:N). Verify the privilege requirement against the vendor before treating PR:L as settled. Overall this is a real but minor issue whose risk is bounded by the local attack vector and the low sensitivity of the disclosed status data.

An attacker with local access to a workstation running GeekezBrowser sends a request to the browser's localhost Public API endpoint /api/status and receives status information that should not be exposed, because the endpoint enforced no authentication and used a wildcard CORS policy. A public PoC reference exists (a GitHub issue) but it is not verified as working exploit code, and exploitation is constrained to the local approach indicated by the CVSS AV:L metric.