CVE-2026-86185 — Bilibili Desktop through 1.18.0 Remote Code Execution via TLS Verification Bypass
Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in…
Published: 2026-09-05 · CVSS: 8.6 · CVSS 4.0
Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed in the renderer with access to the privileged IPC bridge, and execute system commands or steal login credentials.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7