Your AI Agent’s Playwright Browser Is Unpatched and Unsandboxed: One Bad Page Can Own Your Laptop

Over the past few months, the way developers write code and automate workflows has changed dramatically. Driven by "vibecoding" and standards like MCP (Model Context Protocol) and playwright-cli, thousands of engineers have connected AI agents (including Claude Code, GitHub Copilot, Microsoft Copilot, Cursor, OpenAI Codex, and Gemini CLI) directly to Playwright, allowing AI to spin up a browser on their laptop, search the web, read documentation, and interact with pages autonomously.

In early November 2026, a security advisory raised by @nisten warned developers running local agents without containers to immediately audit and remove Playwright's default browser binaries from their agent workflows: the latest stable release of Playwright (1.64.1) bundles an early beta build of Chromium 156 (156.0.8078.4) affected by multiple critical vulnerabilities (CVE-2026-118306, CVE-2026-118331, CVE-2026-118348, CVE-2026-118344), plus a fifth critical flaw (CVE-2026-76024) patched in late October, and Playwright launches browsers with the OS security sandbox disabled by default (--no-sandbox).

When most people picture a browser-based cyberattack, they imagine a user downloading a malicious file. With Playwright wired up to a local AI agent, the attack surface is far more insidious: the agent only needs to visit a single compromised or malicious webpage for an attacker to achieve arbitrary code execution directly on the host operating system: exfiltrating SSH keys, cloud credentials, .env files, and saved passwords.

Below is a verified technical analysis of the root cause, the exact NVD/Chromium CVE specifications, how different AI tools (@playwright/mcp, playwright-cli, and custom agent scripts) actually behave under the hood, a universal 30-second zero-install audit, and a step-by-step hardening guide for Claude, Microsoft Copilot, GitHub Copilot, Cursor, OpenAI Codex, Google Gemini CLI, Google Antigravity, and Docker.

1. The Root Cause: The "Frozen" Browser Bundled Inside Playwright

To understand the risk, you have to distinguish the lifecycle of a standard desktop browser from one managed by Playwright.

When you use Google Chrome or Microsoft Edge on your workstation, the browser updates silently in the background and applies patches on relaunch. Playwright, by contrast, was architected for deterministic End-to-End (E2E) testing: so that a test suite behaves identically across runs, Playwright downloads and pins its own private build of Chromium (Google Chrome for Testing and Chrome Headless Shell) inside a local OS cache directory (ms-playwright).

Because Playwright intentionally tracks Chromium builds ahead of the stable channel to help developers test upcoming browser changes, it pins an early build of each major milestone. That private copy never auto-updates: it remains frozen on disk until a new Playwright version is released and the developer manually updates both the package and the browser binaries.

The Verified Timeline

• September 29–30, 2026: Google promotes Chrome 156.0.8078.4 to the Beta channel.
• October 13–14, 2026 (npm) / October 22, 2026 (PyPI): Microsoft releases Playwright 1.64.0 and 1.64.1, pinning Chromium 156.0.8078.4 (revision: 1248) across Linux, macOS, and Windows.
• October 27, 2026: Google releases a Stable channel update for Desktop (156.0.8078.73/.74 for Windows/macOS, .73 for Linux), patching 52 security vulnerabilities (4 rated Critical, 46 High, and 2 Medium by Chromium), including CVE-2026-118306, CVE-2026-118331, CVE-2026-118348, and CVE-2026-118344.
• October 29, 2026: Google releases a second Stable channel update (156.0.8078.79/.80 for Windows/macOS, .79 for Linux) fixing 21 additional security vulnerabilities, including a fifth Chromium-rated Critical flaw (CVE-2026-76024).
• October 30, 2026: Microsoft releases Edge Stable 156.0.4314.58 incorporating the upstream Chromium security fixes.

Because the Chromium binary inside Playwright 1.64.1 is frozen at 156.0.8078.4, it is missing all 73 security patches shipped by Google between October 27 and October 29.

(Note: The October 27 update also patched High-rated flaws such as CVE-2026-118308, a Use-After-Free in SVG scored at CVSS 9.6 Critical that likewise permits code execution outside the sandbox).

2. The Double Trap: chromiumSandbox: false and @playwright/mcp Defaults

In a standard desktop browser, every tab runs inside an OS-level Sandbox that blocks a compromised renderer from accessing the host filesystem. Even if a malicious webpage triggers an in-sandbox RCE bug (CVE-2026-118331, CVE-2026-118348, or CVE-2026-118344), the attacker stays confined to the renderer process unless they chain a sandbox escape.

With Playwright and AI agents, developers face a two-part trap depending on how their agent launches the browser:

Trap A: Playwright Library, Test Runner & Agent Frameworks (browser-use, AutoGen, Scripts)

When an AI agent writes or runs Playwright code directly (playwright in Python/Node.js, @playwright/test, browser-use, Stagehand, or AutoGen):

• It uses the frozen ms-playwright Chromium 156.0.8078.4 (r1248) binary by default.
• In Playwright's API (browserType.launch()), chromiumSandbox defaults to false (originally designed so Linux CI/CD containers without user-namespace privileges wouldn't crash at startup).

Trap B: @playwright/mcp and playwright-cli (@playwright/cli)

Microsoft offers two official agent integrations: @playwright/mcp (the Model Context Protocol server) and playwright-cli (@playwright/cli, a token-efficient CLI for coding agents).

• Which browser do they launch? Unlike @playwright/test, both @playwright/mcp and playwright-cli default to launching your system's branded Google Chrome (channel: 'chrome') rather than bundled Chromium—unless you pass --browser chromium, run inside the Playwright Docker image, or do not have Google Chrome installed.
• Why is @playwright/mcp still dangerous out of the box?
  • Sandbox Disabled by Default: When @playwright/mcp launches your system Chrome via playwright-core, its command-line normalizer passes --no-sandbox by default unless you explicitly pass --sandbox (or set PLAYWRIGHT_MCP_SANDBOX=true).
  • Config File chromiumSandbox: true Bug (microsoft/playwright-mcp#1716): Until recently, setting "chromiumSandbox": true inside an MCP JSON configuration file was silently discarded and overwritten with false because the CLI parser collapsed any omitted --sandbox CLI flag into false. Passing --sandbox on the command line is mandatory.
  • Persistent Profile on Disk: By default, @playwright/mcp creates a persistent mcp-chrome user profile on disk, preserving cookies and session tokens across runs unless --isolated is passed.

Why You Must Fix Both the Binary AND the Sandbox

If you run with --no-sandbox, any in-sandbox renderer bug (CVE-2026-118331, CVE-2026-118348, CVE-2026-118344) immediately executes with your local user account permissions, exposing ~/.ssh, ~/.aws, .env files, and cloud CLI tokens.

Conversely, if you enable --sandbox but allow Playwright to use its bundled 156.0.8078.4 binary, CVE-2026-118306 (CVSS 9.6) and CVE-2026-118308 (CVSS 9.6) already execute code outside the sandbox. You must both delete the bundled 156.0.8078.4 binary and enforce --sandbox on an updated system browser (>= 156.0.8078.79/.80).

3. 30-Second Universal Security Audit (Zero-Install Check)

⚠️ Critical Warning on npx: Do not run npx playwright --version in your home directory (~) to check if you are affected. Because MCP servers and IDEs cache packages inside isolated subdirectories (~/.npm/_npx), running npx playwright outside a project directory will prompt npm to download and install [email protected] onto a clean machine.

Use the zero-install commands below. They inspect your OS browser cache and running processes directly and work reliably across all machines.

Step 1: Check Your OS Cache for Vulnerable Playwright Chromium Binaries

Playwright stores its downloaded browsers in an OS-specific ms-playwright cache directory (~/Library/Caches/ms-playwright on macOS, ~/.cache/ms-playwright on Linux, %LOCALAPPDATA%\ms-playwright on Windows) unless overridden by $PLAYWRIGHT_BROWSERS_PATH.

Modern Playwright installs Chromium under the name Google Chrome for Testing (inside chromium-XXXX) and chrome-headless-shell (inside chromium_headless_shell-XXXX).

macOS (Terminal — zsh / bash)

PW_CACHE="${PLAYWRIGHT_BROWSERS_PATH:-$HOME/Library/Caches/ms-playwright}"
if [ -d "$PW_CACHE" ]; then
  echo "WARNING: Playwright browser cache found at $PW_CACHE:"
  ls -la "$PW_CACHE"
  echo ""
  echo "Inspecting installed browser binaries and versions:"
  command find "$PW_CACHE" -maxdepth 8 \( -name "Google Chrome for Testing" -o -name "Chromium" -o -name "chrome-headless-shell" \) -type f -perm -u+x -exec sh -c 'printf "%s -> " "$1"; "$1" --version' _ {} \; 2>/dev/null
else
  echo "SAFE: No Playwright browser cache found on this Mac."
fi

(Note: command find prevents interference from shell aliases like alias find=fd. We use -maxdepth 8 because on macOS, Google Chrome for Testing resides 6 levels deep inside an .app bundle, which -maxdepth 5 fails to reach. -perm -u+x guarantees POSIX compatibility across BSD and GNU find).

Linux (Bash)

PW_CACHE="${PLAYWRIGHT_BROWSERS_PATH:-$HOME/.cache/ms-playwright}"
if [ -d "$PW_CACHE" ]; then
  echo "WARNING: Playwright browser cache found at $PW_CACHE:"
  ls -la "$PW_CACHE"
  echo ""
  echo "Inspecting installed browser binaries and versions:"
  command find "$PW_CACHE" -maxdepth 8 \( -name "chrome" -o -name "Chromium" -o -name "Google Chrome for Testing" -o -name "chrome-headless-shell" \) -type f -perm -u+x -exec sh -c 'printf "%s -> " "$1"; "$1" --version' _ {} \; 2>/dev/null
else
  echo "SAFE: No Playwright browser cache found on this Linux host."
fi

Windows (PowerShell)

$PwCache = if ($env:PLAYWRIGHT_BROWSERS_PATH) { $env:PLAYWRIGHT_BROWSERS_PATH } else { "$env:LOCALAPPDATA\ms-playwright" }
if (Test-Path $PwCache) {
    Write-Host "WARNING: Playwright browser cache found at $PwCache" -ForegroundColor Yellow
    Get-ChildItem $PwCache
    Write-Host "`nInspecting installed browser binaries and versions:"
    Get-ChildItem -Path $PwCache -Recurse -File -ErrorAction SilentlyContinue | Where-Object { $_.Name -in @('chrome.exe', 'chrome-headless-shell.exe') } | ForEach-Object {
        Write-Host "$($_.FullName) -> " -NoNewline
        & $_.FullName --version
    }
} else {
    Write-Host "SAFE: No Playwright browser cache found on this Windows machine." -ForegroundColor Green
}

How to interpret the result:

• Safe: SAFE: No Playwright browser cache found...
• Vulnerable: You see folder chromium-1248 (or chromium_headless_shell-1248) or version output 156.0.8078.4 (or any unpatched build prior to 156.0.8078.79/.80).

Step 2: Check If Playwright Is Cached in npx or Local Repositories

Even if ms-playwright is empty, check whether an IDE or CLI agent has cached @playwright/mcp, @playwright/test, @playwright/cli, or playwright inside your npx cache:

macOS / Linux

if [ -d "$HOME/.npm/_npx" ]; then
  command find "$HOME/.npm/_npx" -maxdepth 3 -name "package.json" -exec command grep -HnE '(@playwright|playwright)' {} + 2>/dev/null || echo "No Playwright packages found in npx cache."
else
  echo "No npx cache directory found."
fi

Windows (PowerShell)

@("$env:LOCALAPPDATA\npm-cache\_npx\*\package.json", "$env:APPDATA\npm-cache\_npx\*\package.json") | Where-Object { Test-Path $_ } | Get-ChildItem -ErrorAction SilentlyContinue | Select-String -Pattern "playwright"

(Tip: To check Playwright inside a specific Node.js project folder without triggering an unwanted download, always pass --no-install: npx --no-install playwright --version).

Step 3: Check for Active Browser Processes Running with --no-sandbox

While your AI agent is actively browsing, run this in another terminal to verify whether --no-sandbox was passed to the browser process:

macOS / Linux

ps aux | command grep -iE "chrome|chromium|msedge|brave" | command grep -v "grep" | command grep -- "--no-sandbox"

Windows (PowerShell)

Get-CimInstance Win32_Process -Filter "name LIKE '%chrome%' OR name LIKE '%msedge%'" | Select-Object CommandLine | Select-String "no-sandbox"

4. The Technical Fix: How to Harden Playwright Immediately

To eliminate both the vulnerable .8078.4 binary and the disabled sandbox, apply these three countermeasures:

1. Update Your System Browser & Purge ms-playwright Binaries

Open Google Chrome (chrome://settings/help), Microsoft Edge (edge://settings/help), or Brave Browser (brave://settings/help), confirm your Chromium version is >= 156.0.8078.79/.80 (or Edge >= 156.0.4314.58), and click Relaunch (patches do not take effect until the browser restarts).

Delete Playwright's cached browser binaries directly from your filesystem:

• macOS:

rm -rf ~/Library/Caches/ms-playwright

• Linux:

rm -rf ~/.cache/ms-playwright

• Windows (PowerShell):

Remove-Item -Recurse -Force "$env:LOCALAPPDATA\ms-playwright" -ErrorAction SilentlyContinue

(Also clean old npx cache entries if previously downloaded: rm -rf ~/.npm/_npx/*playwright* or remove the matching directories identified in Step 2).

2. Harden Custom Playwright Scripts (TypeScript / JavaScript / Python / .NET)

Whenever you or your agents invoke Playwright in code, explicitly set channel: 'chrome' (or 'msedge') so it uses your auto-updated system browser, and set chromiumSandbox: true:

💡 Important for users without Google Chrome: If Google Chrome is not installed at the default OS location (/Applications/Google Chrome.app), Playwright cannot use channel: 'chrome'. Install Google Chrome or Microsoft Edge, or pass executablePath pointing to your system Chromium browser (e.g., Brave Browser: executablePath: '/Applications/Brave Browser.app/Contents/MacOS/Brave Browser').

TypeScript / JavaScript

import { chromium } from 'playwright';

const browser = await chromium.launch({
  channel: 'chrome',        // Or 'msedge' on Windows; uses patched system browser
  chromiumSandbox: true,    // Mandatory: Playwright defaults to false!
  headless: true,
});

Python (playwright / AutoGen / browser-use)

from playwright.sync_api import sync_playwright

with sync_playwright() as p:
    browser = p.chromium.launch(
        channel="chrome",         # Or "msedge"
        chromium_sandbox=True,    # Mandatory: re-enables the OS sandbox
        headless=True
    )

.NET / C# (Microsoft.Playwright / Semantic Kernel)

using var playwright = await Playwright.CreateAsync();
await using var browser = await playwright.Chromium.LaunchAsync(new BrowserTypeLaunchOptions
{
    Channel = "msedge",       // Or "chrome"
    ChromiumSandbox = true,   // Mandatory: forces OS sandbox activation
    Headless = true
});

5. How Each AI Agent & Platform Is Affected (Verified Architecture Matrix)

Different AI assistants drive browsers through completely different mechanisms—some run in the cloud, some use the Chrome DevTools MCP, and others use @playwright/mcp, playwright-cli, or local Python/Node scripts.

A. Hardening Claude Code (CLI) & Claude Desktop

ℹ️ Bug Alert for Claude Code Plugin Users (anthropics/claude-code#26643 / #24586): If you installed the Playwright plugin from the official Claude Code Marketplace (playwright@claude-plugins-official), Claude Code hardcodes npm exec @playwright/mcp@latest --headless and silently ignores custom args edited in .mcp.json! To ensure --sandbox is actually applied, uninstall the marketplace plugin and register the MCP server directly via claude mcp add—and export the environment variables in your shell profile (~/.zshrc or ~/.bashrc) as a defense-in-depth guarantee.

In Claude Desktop (claude_desktop_config.json):

Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "playwright": {
      "command": "npx",
      "args": [
        "-y",
        "@playwright/mcp@latest",
        "--browser",
        "chrome",
        "--sandbox",
        "--isolated"
      ],
      "env": {
        "PLAYWRIGHT_MCP_BROWSER": "chrome",
        "PLAYWRIGHT_MCP_SANDBOX": "true",
        "PLAYWRIGHT_MCP_ISOLATED": "true"
      }
    }
  }
}

In Claude Code (CLI):

# Remove any existing unhardened playwright MCP entry
claude mcp remove playwright

# Re-add with explicit CLI flags (--sandbox is required on the CLI)
claude mcp add playwright -- npx -y @playwright/mcp@latest --browser chrome --sandbox --isolated

Also add these environment variables to your ~/.zshrc or ~/.bashrc so even subprocesses that drop CLI arguments stay sandboxed:

export PLAYWRIGHT_MCP_BROWSER="chrome"
export PLAYWRIGHT_MCP_SANDBOX="true"
export PLAYWRIGHT_MCP_ISOLATED="true"

B. Hardening GitHub Copilot (VS Code & Copilot CLI) and Cursor

The official one-click install commands for VS Code, Copilot CLI, and Cursor launch @playwright/mcp@latest without --sandbox. Update your configuration as follows:

Cursor (~/.cursor/mcp.json) & Visual Studio (.mcp.json):

{
  "mcpServers": {
    "playwright": {
      "command": "npx",
      "args": [
        "-y",
        "@playwright/mcp@latest",
        "--browser",
        "chrome",
        "--sandbox",
        "--isolated"
      ]
    }
  }
}

GitHub Copilot CLI (~/.copilot/mcp-config.json):

{
  "mcpServers": {
    "playwright": {
      "type": "local",
      "command": "npx",
      "tools": ["*"],
      "args": [
        "-y",
        "@playwright/mcp@latest",
        "--browser",
        "chrome",
        "--sandbox",
        "--isolated"
      ]
    }
  }
}

VS Code (GitHub Copilot Agent Mode — .vscode/mcp.json or terminal):

# Use "chrome" or "msedge"
code --add-mcp '{"name":"playwright","command":"npx","args":["-y","@playwright/mcp@latest","--browser","chrome","--sandbox","--isolated"]}'

C. Hardening Google Antigravity, Google Gemini CLI & OpenAI Codex CLI

• Google Antigravity:
  Antigravity's built-in browser capabilities use the Chrome DevTools MCP server connected to your system Google Chrome inside an isolated Chrome profile—it does not install or run Playwright. You only need to keep your system Google Chrome updated (chrome://settings/help -> >= 156.0.8078.79/.80).
• OpenAI Codex CLI (~/.codex/config.toml):

[mcp_servers.playwright]
command = "npx"
args = ["-y", "@playwright/mcp@latest", "--browser", "chrome", "--sandbox", "--isolated"]

• Google Gemini CLI (~/.gemini/settings.json) — if using @playwright/mcp:

{
  "mcpServers": {
    "playwright": {
      "command": "npx",
      "args": [
        "-y",
        "@playwright/mcp@latest",
        "--browser",
        "chrome",
        "--sandbox",
        "--isolated"
      ]
    }
  }
}

6. The Docker Trap: Why Default Playwright Containers Still Need Hardening

Running Playwright inside a standard Docker container does not automatically activate the Chromium sandbox, and official Playwright Docker images (mcr.microsoft.com/playwright and mcr.microsoft.com/playwright/mcp) bundle Playwright's pinned Chromium build inside /ms-playwright.

Furthermore, running a container as root forces Chromium to disable its sandbox. If you bind-mount local source code, .env files, or SSH agent sockets into the container, a browser exploit compromises everything mounted inside it.

When running @playwright/mcp in Docker:

1. Run as the unprivileged pwuser user.
2. Drop all unnecessary kernel capabilities, make the root filesystem read-only, and increase /dev/shm (Chromium crashes if /dev/shm is stuck at Docker's 64MB default).
3. Do not mount sensitive host directories (~/.ssh, ~/.aws, or production .env files) into the container.

docker run --rm -i \
  --user pwuser \
  --shm-size=2g \
  --security-opt no-new-privileges \
  --cap-drop=ALL \
  --read-only \
  --tmpfs /tmp:rw,noexec,nosuid,size=512m \
  --tmpfs /home/pwuser:rw,noexec,nosuid,size=256m \
  mcr.microsoft.com/playwright/mcp:latest \
  --headless --isolated

7. Security Engineer Checklist for AI Agent Browsing

1. Delete cached ms-playwright binaries (156.0.8078.4 / r1248) from ~/Library/Caches/ms-playwright, ~/.cache/ms-playwright, or %LOCALAPPDATA%\ms-playwright.
2. Force your patched system browser (--browser chrome or --browser msedge) and verify it is running Chrome >= 156.0.8078.79/.80 or Edge >= 156.0.4314.58.
3. Always pass --sandbox on the MCP CLI (and set PLAYWRIGHT_MCP_SANDBOX=true)—never rely on config files alone due to microsoft/playwright-mcp#1716.
4. Always pass --isolated so @playwright/mcp uses an in-memory profile instead of persisting session state on disk.
5. Do not treat --allowed-origins as a hard security boundary: Per Playwright MCP's official documentation, --allowed-origins restricts initial requests but does not block HTTP or JavaScript redirects. If an agent must browse untrusted third-party sites, isolate the entire agent inside a dedicated VM, cloud dev box, or credential-free container.