Tauri Updater Plugin CVE-2026-95624

Requires all of: (1) a pre-existing XSS vulnerability in the Tauri application's frontend to run attacker JavaScript in the webview; (2) the app using tauri-plugin-updater 2.8.0 through 2.11.x with the default permission set that grants allow-check to the webview; (3) the application NOT having set a custom Builder::default_version_comparator, which takes precedence and neutralizes the flag; and (4) an attacker-controlled or compromised update endpoint capable of serving an older, still-validly-signed release (the updater verifies artifact signature but not advertised version). The description further notes the strongest downgrade path is 'combined with another bug.' Limiting factors: the XSS foothold prerequisite, the need to influence the update feed, and UI:R interaction all constrain realistic exploitation despite the network vector and lack of authentication.

This is a genuine but conditional integrity/broken-access-control issue, not a drop-everything emergency. The vendor CVSS of 6.8 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) correctly reflects the tension: the attack surface is network-reachable and needs no authentication (PR:N), but AC:H captures that exploitation is not self-contained - it presupposes a pre-existing XSS in the app frontend AND, per the description, chaining with 'another bug' plus a malicious/compromised update endpoint. No EPSS score, KEV entry, POC, or SSVC data is provided, so exploitation status is: no public exploit identified at time of analysis. The C:H/I:H rating is arguably generous for the direct primary impact, which is really integrity - silently installing an older, validly-signed release (a downgrade), thereby reintroducing previously-patched vulnerabilities; confidentiality impact is indirect/downstream rather than immediate. Net: prioritize patching for apps that ship the updater plugin, but the XSS-prerequisite and update-feed-control requirements make mass, opportunistic exploitation unlikely. Missing signals (no EPSS/KEV/POC) mean risk is inferred from CVSS and the vendor advisory rather than observed exploitation.

An attacker who has achieved XSS in a Tauri app's webview injects JavaScript that calls the default-permitted 'plugin:updater|check' IPC command with allowDowngrades:true, flipping the version comparator from 'must be newer' to 'must be different.' Combined with a compromised or attacker-influenced update endpoint serving an older but still validly-signed release, the app downgrades itself to a version containing known-exploitable flaws. No public exploit code is identified at time of analysis; the chain requires a pre-existing XSS foothold.