CodeVetter · Repo Unpack · Risk map
browser-use/browser-use
The highest-risk surfaces are arbitrary page JavaScript, the remote sandbox that cloudpickles and ships user code, secret substitution, file upload and external file reads, and domain policy that is off unless configured. Several controls exist and are tested (domain filter, IP blocking, upload whitelist, sensitive-data redaction), but the JavaScript evaluate path only fixes quotes, the flat sensitive_data format is global, and CrashWatchdog is disabled. Docs in AGENTS.md disagree with Agent.__init__ defaults, which is a trap for agents editing call sites.
- evaluate sends the model-supplied string to CDP Runtime.evaluate with awaitPromise and returnByValue after _validate_and_fix_javascript, which only rewrites escaped quotes, regex escapes, and a few selector quote styles. There is no script allowlist or CSP wrapper.
- @sandbox base64-encodes cloudpickle.dumps of the closure and sends the reconstructed source plus pickled params to sandbox.api.browser-use.com with the API key in X-API-Key. That is remote code execution of whatever the decorated function closes over.
- Legacy sensitive_data entries that are plain strings (not nested under a domain pattern) are merged into applicable_secrets for every URL. Domain-scoped entries are filtered with match_url_with_domain_pattern. Missing placeholders are logged, not raised.
- read_file treats a string that is exactly in available_file_paths as an external file and opens that path with anyio.open_file, python-docx, or pypdf. The check is equality, not a resolved-path containment check. upload_file has the same membership test.
- FileSystem.__init__ deletes and recreates base_dir/browseruse_agent_data with shutil.rmtree when that subdirectory already exists. Passing a file_system_path that already contains a browseruse_agent_data directory wipes it.
- SecurityWatchdog allows every URL when both allowed_domains and prohibited_domains are unset. disable_security on BrowserProfile appends CHROME_DISABLE_SECURITY_ARGS to the Chrome launch flags. block_ip_addresses defaults to False.
- ProductTelemetry is on by default (ANONYMIZED_TELEMETRY defaults true) and sends events to https://eu.i.posthog.com with a project API key hardcoded in telemetry/service.py. The device id is persisted at ~/.config/browseruse/device_id or derived from MAC and hostname. Opt out with ANONYMIZED_TELEMETRY=false.
- Crash recovery is not wired: the CrashWatchdog import and event subscriptions inside attach_all_watchdogs are comments. Browser disconnects are handled instead by Agent._handle_step_error waiting on browser_session._reconnect_event.
- AGENTS.md documents Agent defaults that do not match the constructor: code uses max_steps=500 on run(), max_actions_per_step=5, max_failures=5, step_timeout=180, and use_vision=True. The checked-in agent guide still says max_steps 100, max_actions_per_step 3, max_failures 3, step_timeout 120, and use_vision 'auto'.
- browser_use/controller/__init__.py only re-exports Controller, which is an alias of Tools. browser_use/beta/service.py duplicates a large slice of Agent (it imports the same history, judge, and message-manager types) and is excluded from pyright as a dynamic beta wrapper.
- MCP mode inserts the package parent onto sys.path, disables logging below CRITICAL, and can run a full Agent (retry_with_browser_use_agent) inside the MCP client process. A compromised or overly broad MCP client therefore gets the same browser and filesystem powers as the library.
- Cloud browser and LLM calls send the API key in headers (X-Browser-Use-API-Key and the chat client's own auth). create_browser logs the live URL at info level. stop_browser PATCHes /api/v2/browsers/{id} with action stop.