THREAT OPS › Threat News › [NVD] CVE-2026-86185 (HIGH 8.0) — Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed
[NVD] CVE-2026-86185 (HIGH 8.0) — Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed
CVE-2026-86185 CVSS: 8.0 HIGH Published: 2026-09-05T12:16:49.240
Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed in the renderer with access to the privileged IPC brid
MITRE ATT&CK techniques
Indicators of compromise
- CVE-2026-86185cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-86185