# Risk map — puppeteer/puppeteer

> Canonical page: https://codevetter.com/unpack/puppeteer/risk-map

# Risk map — puppeteer/puppeteer

Scanned commit 2e45a3af43231cd658285e4da5e7f53e40f24edf (2026-10-02). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

These are security-sensitive source observations and explicitly labeled hypotheses, not confirmed vulnerabilities. The largest trust boundaries involve browser executables, downloaded archives, remote debugging endpoints, host callbacks, and filesystem paths. Platform utilities and protocol differences add compatibility and failure-path uncertainty. The bounded inspection also identified a likely extension-launch synchronization issue requiring runtime reproduction.
- BrowserLauncher inherits process.env by default and spawns a configured executable with consumer arguments; Chrome additionally honors PUPPETEER_DANGEROUS_NO_SANDBOX=true by adding --no-sandbox. — [packages/puppeteer-core/src/node/BrowserLauncher.ts#L129-L149](https://github.com/puppeteer/puppeteer/blob/2e45a3af43231cd658285e4da5e7f53e40f24edf/packages/puppeteer-core/src/node/BrowserLauncher.ts#L129-L149) [packages/browsers/src/launch.ts#L357-L366](https://github.com/puppeteer/puppeteer/blob/2e45a3af43231cd658285e4da5e7f53e40f24edf/packages/browsers/src/launch.ts#L357-L366) [packages/puppeteer-core/src/node/ChromeLauncher.ts#L262-L267](https://github.com/puppeteer/puppeteer/blob/2e45a3af43231cd658285e4da5e7f53e40f24edf/packages/puppeteer-core/src/node/ChromeLauncher.ts#L262-L267)
- BrowserURL connection performs a caller-directed fetch and trusts webSocketDebuggerUrl; Node channel connection reads DevToolsActivePort from the browser profile, making endpoint and profile provenance relevant trust boundaries. — [packages/puppeteer-core/src/common/BrowserConnector.ts#L126-L179](https://github.com/puppeteer/puppeteer/blob/2e45a3af43231cd658285e4da5e7f53e40f24edf/packages/puppeteer-core/src/common/BrowserConnector.ts#L126-L179) [packages/puppeteer-core/src/common/BrowserConnector.ts#L197-L212](https://github.com/puppeteer/puppeteer/blob/2e45a3af43231cd658285e4da5e7f53e40f24edf/packages/puppeteer-core/src/common/BrowserConnector.ts#L197-L212)
- HTTP authentication sends username/password through CDP, while Connection's optional send logger records serialized protocol messages; enabling that logger can expose authentication payloads. — [packages/puppeteer-core/src/cdp/NetworkManager.ts#L431-L438](https://github.com/puppeteer/puppeteer/blob/2e45a3af43231cd658285e4da5e7f53e40f24edf/packages/puppeteer-core/src/cdp/NetworkManager.ts#L431-L438) [packages/puppeteer-core/src/cdp/Connection.ts#L179-L187](https://github.com/puppeteer/puppeteer/blob/2e45a3af43231cd658285e4da5e7f53e40f24edf/packages/puppeteer-core/src/cdp/Connection.ts#L179-L187)
- exposeFunction installs browser-visible bindings backed by caller-provided host functions and new-document scripts; screenshot file output forwards caller paths directly to environment.writeFile. — [packages/puppeteer-core/src/cdp/Page.ts#L805-L830](https://github.com/puppeteer/puppeteer/blob/2e45a3af43231cd658285e4da5e7f53e40f24edf/packages/puppeteer-core/src/cdp/Page.ts#L805-L830) [packages/puppeteer-core/src/api/Page.ts#L2564-L2572](https://github.com/puppeteer/puppeteer/blob/2e45a3af43231cd658285e4da5e7f53e40f24edf/packages/puppeteer-core/src/api/Page.ts#L2564-L2572)
- Archive integrity verification is optional through expectedHash; installUrl reuses an existing archive without calling downloadFile, and archive-only mode returns an existing file before the verification branch. — [packages/browsers/src/httpUtil.ts#L110-L119](https://github.com/puppeteer/puppeteer/blob/2e45a3af43231cd658285e4da5e7f53e40f24edf/packages/browsers/src/httpUtil.ts#L110-L119) [packages/browsers/src/install.ts#L416-L429](https://github.com/puppeteer/puppeteer/blob/2e45a3af43231cd658285e4da5e7f53e40f24edf/packages/browsers/src/install.ts#L416-L429) [packages/browsers/src/install.ts#L481-L499](https://github.com/puppeteer/puppeteer/blob/2e45a3af43231cd658285e4da5e7f53e40f24edf/packages/browsers/src/install.ts#L481-L499)
- Extraction crosses subprocess boundaries through native ZIP utilities, bzip2/xz, DMG mounting/copying, and Windows installers; escaping-symlink validation is explicit in the yauzl implementation, so that test does not establish equivalent native-tool behavior. — [packages/browsers/src/fileUtil.ts#L37-L55](https://github.com/puppeteer/puppeteer/blob/2e45a3af43231cd658285e4da5e7f53e40f24edf/packages/browsers/src/fileUtil.ts#L37-L55) [packages/browsers/src/fileUtil.ts#L139-L156](https://github.com/puppeteer/puppeteer/blob/2e45a3af43231cd658285e4da5e7f53e40f24edf/packages/browsers/src/fileUtil.ts#L139-L156) [packages/browsers/src/fileUtil.ts#L163-L189](https://github.com/puppeteer/puppeteer/blob/2e45a3af43231cd658285e4da5e7f53e40f24edf/packages/browsers/src/fileUtil.ts#L163-L189) [packages/browsers/src/fileUtil.ts#L258-L315](https://github.com/puppeteer/puppeteer/blob/2e45a3af43231cd658285e4da5e7f53e40f24edf/packages/browsers/src/fileUtil.ts#L258-L315) [packages/browsers/src/fileUtil.ts#L379-L390](https://github.com/puppeteer/puppeteer/blob/2e45a3af43231cd658285e4da5e7f53e40f24edf/packages/browsers/src/fileUtil.ts#L379-L390)
- Optional dependency installation runs root-only apt-get satisfy using downloaded deb.deps; experimental bisect downloads an upstream main-branch Python script into the home directory and executes python3. — [packages/browsers/src/install.ts#L343-L375](https://github.com/puppeteer/puppeteer/blob/2e45a3af43231cd658285e4da5e7f53e40f24edf/packages/browsers/src/install.ts#L343-L375) [packages/browsers/src/CLI.ts#L539-L577](https://github.com/puppeteer/puppeteer/blob/2e45a3af43231cd658285e4da5e7f53e40f24edf/packages/browsers/src/CLI.ts#L539-L577)
- Hypothesis: extension-enabled launch can complete before extension installation settles because Promise.all receives one nested array of installation promises rather than the promises themselves; rejection propagation may also be lost. (inferred) — [packages/puppeteer-core/src/node/BrowserLauncher.ts#L357-L371](https://github.com/puppeteer/puppeteer/blob/2e45a3af43231cd658285e4da5e7f53e40f24edf/packages/puppeteer-core/src/node/BrowserLauncher.ts#L357-L371)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)