Playwright installs an outdated Chrome with disabled sandbox, creating security risk for AI agents running outside containers.
AI & Agents ·
Playwright 1.64.1 bundles an outdated Chromium build (156.0.8078.4) that lacks patches for multiple critical vulnerabilities, while its sandboxing feature—which protects against malicious code execution—defaults to disabled. The version shipped on November 2 lags behind Chrome stable's October 29 release (156.0.8078.79/.80), missing five critical fixes including CVE-2026-118306, CVE-2026-118331, CVE-2026-118348, CVE-2026-118344, and CVE-2026-76024. Earlier versions carry additional risk: 1.63 likely lacks CVE-2026-87491 (which has seen active exploitation), while 1.62 and 1.61 miss both that flaw and CVE-2026-85046.
According to the report, when Chromium's sandbox is off, a successful exploit grants an attacker user-level access to files, environment variables, SSH keys, and authentication tokens. The issue compounds because Playwright's MCP server does not function as a security boundary, and Docker deployments run as root by default—a configuration that further disables sandboxing. Playwright's own documentation does not recommend the setup for untrusted websites.
Remediation steps include upgrading to the latest Playwright (especially from 1.63 or below), enabling chromiumSandbox explicitly, and isolating browsing agents in containers or VMs without real credentials or home directories. No confirmed exploitation of the October bugs through Playwright has been reported to date, though the ChatGPT desktop app reportedly ships with this bundled version.