CVE-2026-86185: Bilibili Desktop through 1.18.0 Remote Code Execution via TLS Verification Bypass
Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed in the renderer with access to the privileged IPC bridge, and execute system commands or steal login credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Bilibili Desktopto a version that resolves this vulnerability.Fixed in 1.18.0 - Configuration
Re-enable TLS certificate verification (do not disable it process-wide) to prevent TLS verification bypass during configuration fetches.
Bilibili Desktop TLS verification TLS certificate verification = enabled - Compensating control
Block or monitor on-path interception of configuration fetches (e.g., enforce network controls so clients cannot be positioned for traffic interception).
- Operational
If login credentials may have been stolen, rotate affected credentials after remediation.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Bilibili Desktop versions through 1.18.0 are exposed when an attacker can occupy an on-path network position during configuration retrieval. The attacker does not need prior privileges or authentication, but user interaction is required.
What does an attacker need to exploit it?
An attacker must be able to intercept the application's network traffic and modify a fetched remote JavaScript configuration. TLS certificate verification is disabled process-wide, allowing the interception to succeed with an untrusted certificate.
What is the potential impact of successful exploitation?
Injected JavaScript runs in the renderer and can access the privileged IPC bridge. This can enable system command execution and theft of login credentials.
What can be done if an update is not immediately available?
The provided information does not identify a workaround. Reducing exposure to untrusted or attacker-controlled networks may limit the opportunity for an on-path attacker to intercept configuration fetches.