Junglewise Threat Intelligence

CVE-2026-12823: Browserbase Skills insecure file permissions in Autobrowse Trace Artifact Handler

CVE-2026-12823 · Severity: low · CVSS 3.3 · Published 2026-06-22

Executive brief

Browserbase Skills, a tool used for web automation and browsing, contains a security flaw in how it saves session logs and trace data. These files are created with overly broad permissions, potentially allowing other users or malicious processes on the same computer to read sensitive information. This data can include login cookies, passwords, and private screenshots captured during automated browsing sessions.

Technical details

The Autobrowse Trace Artifact Handler in Browserbase Skills (up to version 20260526) writes trace files—including trace.json, messages.json, and screenshots—using default filesystem permissions (fs.writeFileSync) without specifying restrictive modes. On systems with permissive umasks or in shared CI/CD environments, these artifacts may become world-readable or group-readable. An attacker with local access to the filesystem can exploit this to extract sensitive runtime data such as Authorization headers, bearer tokens, session cookies, and raw tool logs. A public proof-of-concept exploit has been released, and the vendor has not yet provided a patch.

Affected products

  • Browserbase Skills (Autobrowse) up to 20260526

Timeline

  • 2026-05: other: Vulnerability discovered and tested against main branch
  • 2026-06-21: disclosed: Public disclosure of the advisory and PoC
  • 2026-06-22: advisory: NVD publication of CVE-2026-12823

References