AIKIDO-2025-10607
browser-use is vulnerable to Authorization Bypass Through User-Controlled Key
75
High Risk
This Affects:
browser-useTL;DR
Affected versions of this package are vulnerable to Authorization Bypass due to an insecure default configuration where the disable_security flag was set to True, which disables key browser security features like Same-Origin Policy and Content Security Policy (CSP). An attacker could exploit this by tricking a user into visiting a malicious webpage, which could then execute arbitrary commands on the machine by abusing the exposed Chrome DevTools Protocol (CDP) connection, potentially leading to a complete compromise of the system.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
browser-use is vulnerable to Authorization Bypass Through User-Controlled Key in versions 0.1.0 - 0.1.40.
How to fix this
Upgrade the browser-use library to the patch version or explicitly set disable_security to False.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant