CVE-2026-75357: Bilibili Bilibili Desktop vulnerability
Published Aug 27, 2026
·Updated
An issue in Bilibili Desktop v.1.17.9 allows a remote attacker to execute arbitrary code via the bili-inject.js and bili-bridge.js components.
Affected Software
1 affected component
Bilibili Bilibili Desktop=1.17.9
Event History
Aug 27, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·05:19 PM
Description
Frequently Asked Questions
1
Which application version is identified as affected?
The issue is reported in Bilibili Desktop version 1.17.9.
2
What application components are involved in the reported code-execution path?
The reported attack path involves the bili-inject.js and bili-bridge.js components.
3
What level of access does an attacker need according to the report?
The report describes the attacker as remote, but does not specify any required user interaction, authentication, or other preconditions.