Executive brief
Bilibili Desktop is a Windows application used to stream and view video content from the Bilibili platform. A flaw in how the application validates sender URLs in its privileged inter-process communication (IPC) bridge allows an attacker to trick the application into executing arbitrary code with the privileges of the logged-in user by crafting a malicious webpage that the application's browser loads.
Technical details
The vulnerability is a sender URL origin validation bypass (CWE-346) in Bilibili Desktop's Electron-based in-app browser. The application injects a preload script that exposes a native IPC bridge to all loaded pages and validates sender URLs using a loose regular-expression substring match (e.g., looking for "bilibili.com" as a substring) rather than parsing the actual hostname. An attacker can craft a malicious URL containing an allowlisted hostname substring (e.g., "http://attacker.com/bilibili.com") that passes the allowlist check but resolves to an attacker-controlled host. This allows the attacker to invoke privileged IPC channels, including a native path-opening function, leading to arbitrary local program execution under the user's account. The vulnerability affects Bilibili Desktop 1.17.9 (and likely earlier versions) on Windows, requires no authentication, and can be exploited by a network attacker if they can inject or control a page loaded in the in-app browser.
Affected products
- Bilibili Bilibili Desktop 1.17.9 and likely earlier versions in the 1.x line
Timeline
- 2026-08-27: disclosed: CVE-2026-75357 published