browser-use web-ui CVE-2026-82640

Exploitation requires a local user account with read access to the filesystem path where browser-use web-ui stores its settings JSON files. The application must have been configured with at least one LLM provider API key through versions 2.0.0 to 3.0.0. No special privileges beyond standard local user access are required to read the files once the application has written them. Exploitation is limited to local or shared-system scenarios - remote unauthenticated access is not possible given AV:L. The attack is further limited to environments where browser-use web-ui has actually been installed and run; it does not affect systems running only the underlying browser-use library without the web-ui component.

The CVSS 4.0 score of 6.8 with vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N reflects the limited blast radius accurately: exploitation requires local filesystem access with at minimum low-privilege credentials, ruling out remote unauthenticated attack. The high confidentiality impact (VC:H) is justified because full API key recovery enables account-level impersonation against the LLM provider. No EPSS data was supplied, and the vulnerability is not listed in CISA KEV, suggesting no observed widespread exploitation at time of writing. The practical risk is elevated wherever browser-use web-ui runs on shared or multi-tenant systems - even a small team environment with shared developer workstations faces meaningful credential theft exposure - but it is negligible on single-user, properly isolated machines. The absence of integrity and availability impact limits the scope to credential exfiltration rather than system compromise. No conflicting signals between CVSS vector and description were identified.

A local attacker on a shared developer workstation locates the predictably-named JSON configuration file written by browser-use web-ui in the application's temporary settings directory. Using standard file read permissions available to any low-privilege local account, the attacker parses the JSON to extract one or more LLM provider API keys. The attacker then uses the stolen keys to make API calls billed to the victim's account or to access data the victim's key is authorized to retrieve.