Skip to content
OpenAdvisories

Vendor

browser-use

3 known vulnerabilities.

Products

web-ui 2 browser-use 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.5
    CVE-2026-82640

    browser-use web-ui 2.0.0 through 3.0.0 Cleartext API Key Storage

    browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions. Attackers with read access to the temporary settings directory can recover provider API keys from predictably-named J…

    browser-use web-ui
  • Medium 5.3
    CVE-2026-82637

    browser-use web-ui 2.0.0 through 3.0.0 Arbitrary Directory Creation

    browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in run_agent_task, allowing attackers to create directories at arbitrary locations by supplying absolute paths to save_recording_path, save_trace_path, save_agent_history_…

    browser-use web-ui
  • Medium 4.0
    CVE-2025-47241

    Browser Use allows bypassing `allowed_domains` by putting a decoy domain in http auth username portion of a URL

    In browser-use (aka Browser Use) before 0.1.45, URL parsing of allowed_domains is mishandled because userinfo can be placed in the authority component.

    browser-use browser-use browser-use PyPI