CVE-2026-120503 in GeekezBrowser
Summary
by MITRE • 11/02/2026
A vulnerability was detected in EchoHS GeekezBrowser up to 1.7.2/1.8.0. This affects an unknown part of the file /api/status of the component Public API. The manipulation results in information disclosure. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 1.8.1 is able to mitigate this issue. The patch is identified as 9317a89aa0fd2715d9c2bd27bdbb52b5d228dd9e. Upgrading the affected component is recommended.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in EchoHS GeekezBrowser versions up to 1.7.2 and 1.8.0 represents a critical information disclosure flaw within its Public API implementation, specifically targeting the /api/status endpoint. This security defect allows an attacker with local access to the system to extract sensitive internal state data that should remain restricted from unauthorized users. The nature of this vulnerability aligns closely with CWE-200, which categorizes issues where exposed technical information could aid in further attacks against a target system or application. By accessing the status endpoint without proper authorization controls, an adversary can gather detailed insights into the browser's operational environment, potentially including version details, active processes, configuration states, or other metadata that reveals architectural weaknesses.
The attack vector for this flaw is classified as local, meaning the attacker must have some form of authenticated access to the device running GeekezBrowser before exploitation can occur. This constraint significantly limits the scope of potential attackers compared to remote vulnerabilities but does not diminish its severity in environments where physical or logical local access might be compromised through social engineering, insider threats, or prior compromise of user accounts. The existence of public exploits indicates that proof-of-concept code is available for download and use by malicious actors who have achieved initial foothold on the target machine. This situation corresponds to aspects of MITRE ATT&CK technique T1087, which involves account discovery through local enumeration, as well as potential data exfiltration techniques where system information serves as reconnaissance material for subsequent lateral movement or privilege escalation attempts.
The operational impact of this vulnerability extends beyond simple privacy concerns. Information disclosed via the /api/status endpoint can serve as a foundational element for more sophisticated attacks within the same network segment or on the local host. Attackers may utilize the gathered data to identify specific software versions running, detect security patches that are missing, or understand the internal logic flow of the application to craft targeted payloads against other components. In enterprise environments where GeekezBrowser might be deployed across multiple endpoints, a successful exploitation could lead to widespread reconnaissance if attackers move laterally between machines using shared credentials or stolen tokens, leveraging the disclosed status information to map out vulnerable systems efficiently.
Mitigation for this issue is straightforward and has been addressed in version 1.8.1 of EchoHS GeekezBrowser. The vendor released patch identifier 9317a89aa0fd2715d9c2bd27bdbb52b5d228dd9e, which corrects the underlying logic error that permitted unauthorized access to sensitive status data. Organizations and individual users currently running affected versions are strongly advised to upgrade immediately to version 1.8.1 or later to eliminate this attack surface. In addition to upgrading, administrators should enforce strict local access controls on devices where GeekezBrowser is installed, ensuring that only authorized personnel have physical or remote desktop access capabilities. Implementing principle of least privilege for user accounts running the browser can further reduce the risk profile by limiting what an attacker could achieve even if they manage to exploit this information disclosure flaw before a patch is applied.