EUVD-2026-38204
GHSA-vxfm-r32r-fgx3
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only attack requiring a low-privileged account (AV:L/PR:L); only limited confidentiality impact from reading trace artifacts, no integrity or availability consequence.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A security flaw has been discovered in Browserbase up to 20260526. This impacts an unknown function of the component Autobrowse Trace Artifact Handler. The manipulation results in incorrect default permissions. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Incorrect default file permissions in Browserbase's Autobrowse Trace Artifact Handler (versions up to 20260526) expose locally stored trace artifact files to low-privileged users on the same host, resulting in unauthorized information disclosure. A public exploit (poc.sh) was released without a vendor patch, as the vendor did not respond to responsible disclosure. With a CVSS 4.0 score of 1.9, the attack is strictly local and limited to confidentiality impact; no KEV listing exists, but publicly available exploit code lowers the bar for exploitation in shared-host environments.
Technical ContextAI
CWE-266 (Incorrect Privilege Assignment) describes the root cause: resources are assigned access rights that are broader than intended, allowing unintended principals to access them. In this case, the Browserbase Autobrowse feature - a browser automation component - generates trace artifact files during session execution. These files are created with insecure default filesystem permissions (likely world-readable), enabling any local user to read them. The affected product is Browserbase version 20260526 per ENISA EUVD-2026-38204; no CPE strings were provided in the source data. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) confirms the local, low-complexity nature of the flaw with limited confidentiality scope and no integrity or availability impact.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to responsible disclosure, and no fixed version has been confirmed from any reference. As a primary compensating control, administrators should manually restrict permissions on the Browserbase Autobrowse trace artifact output directory to the owning user only (e.g., apply chmod 700 or chmod 750 to the trace artifact directory), preventing other local users from reading generated files; this is low-risk and immediately actionable. Additionally, restrict Browserbase deployments to single-user or containerized/isolated environments where untrusted local accounts cannot coexist with the process. Monitor https://vuldb.com/vuln/372613 and https://nvd.nist.gov/vuln/detail/CVE-2026-12823 for any vendor-issued patch or updated advisory. The public POC and advisory are available at https://github.com/NARKHEDE-VAIBHAV/poc/blob/main/CVE-2026-12823%20-%20Browserbase%20Skills%20Autobrowse%20Trace%20Artifact%20Insecure%20File%20Permissions/Advisory.md for reference during impact assessment.
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today