browser-use

Agents that use the browser.

View on Pypi

View on Github

Activity

Latest release: 1w ago
Total releases: 139
Cadence: ~3 days
Last 12 months: 52

Reach

Stars: 114.0k

Details

License: MIT
First release: Nov 06, 2024

Releases

Version	Released
`0.13.10` patch	Sep 04, 2026
`0.13.9` patch	Sep 04, 2026
`0.13.8` patch	Aug 16, 2026
`0.13.7` patch	Jul 27, 2026
`0.13.6` patch	Jul 17, 2026
`0.13.5` patch	Jul 17, 2026
`0.13.4` patch	Jul 11, 2026
`0.13.3` patch	Jul 02, 2026
`0.13.1` patch	Jun 10, 2026
`0.13.0` minor	Jun 08, 2026
`0.13.0rc4` pre	Jun 08, 2026
`0.13.0rc3` pre	Jun 08, 2026
`0.13.0rc2` pre	Jun 08, 2026
`0.12.9` patch	May 26, 2026
`0.12.8` patch	May 23, 2026
`0.12.7` patch	May 19, 2026
`0.12.6` patch	Apr 02, 2026
`0.12.5` patch	Mar 25, 2026
`0.12.4` patch	Mar 24, 2026
`0.12.3` patch	Mar 23, 2026
`0.12.2` patch	Mar 12, 2026
`0.12.1` patch	Mar 03, 2026
`0.12.0` minor	Feb 26, 2026
`0.11.13` patch	Feb 25, 2026
`0.11.12` patch	Feb 23, 2026
`0.11.11` patch	Feb 20, 2026
`0.11.10a2` pre	Feb 17, 2026
`0.11.10a1` pre	Feb 12, 2026
`0.11.9` patch	Feb 06, 2026
`0.11.8` patch	Feb 03, 2026
`0.11.7` patch	Feb 01, 2026
`0.11.6` patch	Feb 01, 2026
`0.11.5` patch	Jan 28, 2026
`0.11.4` patch	Jan 22, 2026
`0.11.3` patch	Jan 16, 2026
`0.11.2` patch	Dec 16, 2025
`0.11.1` patch	Dec 12, 2025
`0.11.0` minor	Dec 10, 2025
`0.10.1` minor	Nov 29, 2025
`0.9.7` patch	Nov 18, 2025
`0.9.6` patch	Nov 15, 2025
`0.9.5` patch	Nov 01, 2025
`0.10.0rc1` pre	Oct 31, 2025
`0.9.4` patch	Oct 29, 2025
`0.9.3` patch	Oct 28, 2025
`0.9.2` patch	Oct 28, 2025
`0.9.1` patch	Oct 24, 2025
`0.9.0` minor	Oct 22, 2025
`0.8.1` patch	Oct 14, 2025
`0.8.0` minor	Oct 09, 2025

1–50 of 139

Repository

browser-use/browser-use

Forks: 12.5k
Open issues: 126
Language: Python

llm
ai-agents
ai-tools
browser-automation
python
browser-use

Dependencies (48)

Depends on

0.13.10

Supply-chain exposure

Known CVEs (1)

CVE-2025-47241 PYSEC-2026-300 GHSA-x39x-9qw5-ghrf Jun 29, 2026

Browser Use allows bypassing `allowed_domains` by putting a decoy domain in http auth username portion of a URL

9.3 / 10
Critical
Network Low None None Changed High None Low

Summary

During a manual source code review, ARIMLABS.AI researchers identified that the browser_use module includes an embedded whitelist functionality to restrict URLs that can be visited. This restriction is enforced during agent initialization. However, it was discovered that these measures can be bypassed, leading to severe security implications.

Details

File: browser_use/browser/context.py

The BrowserContextConfig class defines an allowed_domains list, which is intended to limit accessible domains. This list is checked in the _is_url_allowed() method before navigation:

@dataclass class BrowserContextConfig: """ [STRIPPED] """ cookies_file: str | None = None minimum_wait_page_load_time: float = 0.5 wait_for_network_idle_page_load_time: float = 1 maximum_wait_page_load_time: float = 5 wait_between_actions: float = 1 disable_security: bool = True browser_window_size: BrowserContextWindowSize = field(default_factory=lambda: {'width': 1280, 'height': 1100}) no_viewport: Optional[bool] = None save_recording_path: str | None = None save_downloads_path: str | None = None trace_path: str | None = None locale: str | None = None user_agent: str = ( 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36' ) highlight_elements: bool = True viewport_expansion: int = 500 allowed_domains: list[str] | None = None include_dynamic_attributes: bool = True _force_keep_context_alive: bool = False

The _is_url_allowed() method is responsible for checking whether a given URL is permitted:

def _is_url_allowed(self, url: str) -> bool: """Check if a URL is allowed based on the whitelist configuration.""" if not self.config.allowed_domains: return True try: from urllib.parse import urlparse parsed_url = urlparse(url) domain = parsed_url.netloc.lower() # Remove port number if present if ':' in domain: domain = domain.split(':')[0] # Check if domain matches any allowed domain pattern return any( domain == allowed_domain.lower() or domain.endswith('.' + allowed_domain.lower()) for allowed_domain in self.config.allowed_domains ) except Exception as e: logger.error(f'Error checking URL allowlist: {str(e)}') return False

The core issue stems from the line domain = domain.split(':')[0], which allows an attacker to manipulate basic authentication credentials by providing a username:password pair. By replacing the username with a whitelisted domain, the check can be bypassed, even though the actual domain remains different.

Proof of Concept (PoC)

Set allowed_domains to ['example.com'] and use the following URL:

https://example.com:pass@localhost:8080

This allows bypassing all whitelist controls and accessing restricted internal services.

Impact

Affected all users relying on this functionality for security.

Potential for unauthorized enumeration of localhost services and internal networks.

Ability to bypass domain whitelisting, leading to unauthorized browsing.

Affected versions

0.1.00.1.10.1.100.1.110.1.120.1.130.1.140.1.150.1.160.1.170.1.180.1.19

+ 30 more Show less

0.1.200.1.210.1.220.1.230.1.240.1.250.1.260.1.270.1.280.1.290.1.30.1.300.1.310.1.320.1.330.1.340.1.350.1.360.1.370.1.380.1.390.1.40.1.400.1.410.1.420.1.430.1.50.1.60.1.70.1.8

Fixed in

0.1.45

References

https://github.com/browser-use/browser-use/security/advisories/GHSA-x39x-9qw5-ghrf
https://nvd.nist.gov/vuln/detail/CVE-2025-47241
https://github.com/browser-use/browser-use/pull/1561
https://github.com/browser-use/browser-use
https://github.com/browser-use/browser-use/releases/tag/0.1.45
https://pypi.org/project/browser-use

Updated Jul 13, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

minor 12
patch 119
pre 7

139 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More