browser-use domain restriction bypass via non-standard protocols leading to internal state disclosure and unauthorized navigation
An attacker can construct malicious links containing non-standard URI schemes such as javascript, file, chrome, or about, and exploit incomplete whitelist validation logic in the security watchdog module to achieve a bypass. The flaw originates from the input filtering mechanism blocking only specific data schemes while failing to cover all protocol types capable of triggering page navigation. When an automated agent visits a compromised page, cross-origin redirects or local file read operations are executed directly. The vulnerability is network-reachable and requires no additional user interaction to trigger; affected instances face risks including internal browser state disclosure, unauthorized access to sensitive paths, and failure of established domain isolation policies.
- It is recommended to replace the blacklist mechanism with a default-deny allowlist validation strategy, strictly limiting the set of permitted communication protocols and enforcing URI format validation. Developers should implement deep packet inspection and protocol header filtering at the routing resolution stage, combined with context-aware input sanitization functions to block unconventional redirect behavior.
