CodeVetter · Repo Unpack · Risk map

puppeteer/puppeteer

Scanned commit 2e45a3af43 dated 2026-10-02 — last upstream commit. Generated by codevetter codevetter 1.15.0 on 2026-10-02. Deep analysis by cli:codex via the codex CLI on 2026-10-02 (402s). Source inspection; upstream code and tests were not executed.

These are security-sensitive source observations and explicitly labeled hypotheses, not confirmed vulnerabilities. The largest trust boundaries involve browser executables, downloaded archives, remote debugging endpoints, host callbacks, and filesystem paths. Platform utilities and protocol differences add compatibility and failure-path uncertainty. The bounded inspection also identified a likely extension-launch synchronization issue requiring runtime reproduction.

BrowserLauncher inherits process.env by default and spawns a configured executable with consumer arguments; Chrome additionally honors PUPPETEER_DANGEROUS_NO_SANDBOX=true by adding --no-sandbox.
packages/puppeteer-core/src/node/BrowserLauncher.ts#L129-L149 packages/browsers/src/launch.ts#L357-L366 packages/puppeteer-core/src/node/ChromeLauncher.ts#L262-L267
BrowserURL connection performs a caller-directed fetch and trusts webSocketDebuggerUrl; Node channel connection reads DevToolsActivePort from the browser profile, making endpoint and profile provenance relevant trust boundaries.
packages/puppeteer-core/src/common/BrowserConnector.ts#L126-L179 packages/puppeteer-core/src/common/BrowserConnector.ts#L197-L212
HTTP authentication sends username/password through CDP, while Connection's optional send logger records serialized protocol messages; enabling that logger can expose authentication payloads.
packages/puppeteer-core/src/cdp/NetworkManager.ts#L431-L438 packages/puppeteer-core/src/cdp/Connection.ts#L179-L187
exposeFunction installs browser-visible bindings backed by caller-provided host functions and new-document scripts; screenshot file output forwards caller paths directly to environment.writeFile.
packages/puppeteer-core/src/cdp/Page.ts#L805-L830 packages/puppeteer-core/src/api/Page.ts#L2564-L2572
Archive integrity verification is optional through expectedHash; installUrl reuses an existing archive without calling downloadFile, and archive-only mode returns an existing file before the verification branch.
packages/browsers/src/httpUtil.ts#L110-L119 packages/browsers/src/install.ts#L416-L429 packages/browsers/src/install.ts#L481-L499
Extraction crosses subprocess boundaries through native ZIP utilities, bzip2/xz, DMG mounting/copying, and Windows installers; escaping-symlink validation is explicit in the yauzl implementation, so that test does not establish equivalent native-tool behavior.
packages/browsers/src/fileUtil.ts#L37-L55 packages/browsers/src/fileUtil.ts#L139-L156 packages/browsers/src/fileUtil.ts#L163-L189 packages/browsers/src/fileUtil.ts#L258-L315 packages/browsers/src/fileUtil.ts#L379-L390
Optional dependency installation runs root-only apt-get satisfy using downloaded deb.deps; experimental bisect downloads an upstream main-branch Python script into the home directory and executes python3.
packages/browsers/src/install.ts#L343-L375 packages/browsers/src/CLI.ts#L539-L577
Hypothesis: extension-enabled launch can complete before extension installation settles because Promise.all receives one nested array of installation promises rather than the promises themselves; rejection propagation may also be lost. (inferred)
packages/puppeteer-core/src/node/BrowserLauncher.ts#L357-L371