Vulnerability in Bilibili Desktop
CVE-2026-86185
Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed in the renderer with access to the privileged IPC bridge, and execute system commands or steal login credentials.
Vulnerability class: Improper Certificate Validation
CVSS v3 metric
CVSS v3 base score 8.0 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
Weakness classification (CWE)
References
- disclosure@vulncheck.com (third-party-advisory)
- disclosure@vulncheck.com (technical-description)
- disclosure@vulncheck.com (product)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-86185?
- CVE-2026-86185 is a high-severity vulnerability in Bilibili Desktop, classified under Improper Certificate Validation. CVSS score: 8.0/10. Published 2026-09-05.
- How severe is CVE-2026-86185?
- High severity. CVSS v3 base score is 8.0 out of 10.