Executive brief
CowAgent is an agent framework that can invoke browser automation tools to interact with web pages. A denial of service vulnerability in the shared browser tool allows an attacker to inject commands through prompt injection that consume the browser's single worker thread for extended periods. When a crafted task causes a long-running browser operation, it blocks subsequent legitimate browser operations from completing within expected timeframes, rendering the service unavailable.
Technical details
CowAgent maintains a process-wide shared BrowserService with a single worker thread that serializes all Playwright operations through a shared queue. The BrowserTool accepts user-controlled wait and evaluate arguments without enforcing reasonable time limits. An attacker can exploit this through prompt injection to cause the agent to call the browser tool with an extremely long wait timeout or long-running script evaluation. When the upstream client times out, the Playwright operation continues to occupy the shared browser thread, causing all subsequent browser operations to queue behind it and exceed their own client deadlines. The vulnerability occurs because caller timeouts do not propagate cancellation to the underlying browser task, and no per-operation time limits are enforced.
Affected products
- zhayujie CowAgent up to 2.1.3
Timeline
- 2026-09-02: disclosed: CVE-2026-84425 published
- 2026-09-02: other: Exploit code made public; vendor did not respond to early disclosure