Coze Scraper Extension CVE-2026-96680

Exploitation requires the victim to have the ByteDance Coze Scraper Chrome extension version <=2.0.2 installed AND to visit or interact with an attacker-controlled web page (UI:P/user interaction). The specific trigger is the extension's externally-exposed message listener chrome.runtime.onMessageExternal.addListener, which processes attacker-supplied body.url/body.urls, paginationConfig, xPathConfig and xPaths without verifying the sender's origin. Limiting factors: it only affects users of this niche extension, needs user interaction (loading the malicious page), and impact is confined to attacker-directed URL scraping with low confidentiality impact and no integrity/availability effect - there is no code execution or authenticated-account compromise.

This is a low-severity, missing-authorization flaw (CWE-862) in the ByteDance Coze Scraper Chrome extension (<=2.0.2), and the signals are consistent with genuinely low real-world risk despite a public exploit. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L, score 2.1) indicates a network-reachable but user-interaction-dependent issue with only low confidentiality impact and no integrity or availability impact - matching the description, where the extension's external message handler (chrome.runtime.onMessageExternal.addListener) accepts scraping parameters (body.url/urls, paginationConfig, xPathConfig, xPaths) from any website without authorization. E:P confirms proof-of-concept exploit code is public (GitHub write-up by xryj920 plus VulDB submission 904123 / vuln 409003). There is no EPSS score and no CISA KEV listing in the input, so there is no evidence of active or automated exploitation - this is publicly-documented but not weaponized at scale. The practical ceiling on impact is that exploitation requires a victim to have this specific niche extension installed and to visit an attacker-controlled page; the payoff is coercing the extension into scraping attacker-chosen URLs (potentially abusing the victim's browser context/IP), not code execution or broad data theft. Net: a real but minor issue, appropriately rated low; not a patching priority for most environments.

An attacker hosts a malicious web page and, when a visitor who has the Coze Scraper extension (<=2.0.2) installed loads it, the page sends a chrome.runtime.onMessageExternal message supplying body.url/urls, xPathConfig and paginationConfig. Because the external message handler performs no origin authorization, the extension scrapes the attacker-specified URLs from within the victim's browser and returns the extracted content to the attacker's page. Public proof-of-concept code exists (GitHub xryj920 write-up and VulDB entry), lowering the effort to reproduce.