EIP-2026-118360

PRE-CVE

Cisco WebEx - 'nativeMessaging' Remote Command Execution

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-118360. PoCs published by Google Security Research.

AI-analyzed exploit summary This exploit leverages a vulnerability in the Cisco WebEx browser extension by abusing the nativeMessaging API to execute arbitrary commands via a crafted CustomEvent. The PoC demonstrates RCE by launching calc.exe through the _wsystem function in MSVCR100.DLL.

Description

Cisco WebEx - 'nativeMessaging' Remote Command Execution

Exploits (1)

exploitdb WORKING POC VERIFIED
by Google Security Research · htmlremotewindows
https://www.exploit-db.com/exploits/41148

This exploit leverages a vulnerability in the Cisco WebEx browser extension by abusing the nativeMessaging API to execute arbitrary commands via a crafted CustomEvent. The PoC demonstrates RCE by launching calc.exe through the _wsystem function in MSVCR100.DLL.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Cisco WebEx browser extension (jlhmfgmfgeifomenelglieieghnjghma)
No auth needed
Prerequisites: Cisco WebEx extension installed · Victim visits a malicious webpage with the specific iframe name
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026