Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
browser-use/browser-harness
main @ 7594909
8
Fixes
0
CVEs
HIGH
Peak severity
42.9%
Coverage
Highlights
Denial of Service: 4 prior fixes. Scrutinize any change in this area.
src/browser_harness/_ipc.py: most-fixed (3 issues). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Denial of Service: Insecure handling of daemon process IDs during signaling can result in integer overflows or the target signaling of critical process groups (e.g., PID 0 or -1), allowing local attackers or buggy components to crash the daemon or system processes.
Insecure Operation on Process: The kernel's recycling of PIDs exposes the administrative tools to a race condition where SIGTERM signals intended for the daemon can be sent to unrelated, newly spawned processes that inherited the recycled PID.
Auth Bypass: Absence of proper token validation on TCP loopback interfaces, specifically on platforms like Windows where UNIX domain sockets are simulated or bypassed, allows unauthorized local users to connect and execute arbitrary browser/CDP commands.