{"id":"CVE-2025-47241","kind":"vulnerability","aliases":["CVE-2025-47241","GHSA-x39x-9qw5-ghrf"],"related":[],"title":"Browser Use allows bypassing `allowed_domains` by putting a decoy domain in http auth username portion of a URL","description":"### Summary  \nDuring a manual source code review, [**ARIMLABS.AI**](https://arimlabs.ai) researchers identified that the `browser_use` module includes an embedded whitelist functionality to restrict URLs that can be visited. This restriction is enforced during agent initialization. However, it was discovered that these measures can be bypassed, leading to severe security implications.  \n\n### Details  \n**File:** `browser_use/browser/context.py`  \n\nThe `BrowserContextConfig` class defines an `allowed_domains` list, which is intended to limit accessible domains. This list is checked in the `_is_url_allowed()` method before navigation:\n\n```python\n@dataclass\nclass BrowserContextConfig:\n    \"\"\"\n    [STRIPPED]\n    \"\"\"\n    cookies_file: str | None = None\n    minimum_wait_page_load_time: float = 0.5\n    wait_for_network_idle_page_load_time: float = 1\n    maximum_wait_page_load_time: float = 5\n    wait_between_actions: float = 1\n\n    disable_security: bool = True\n\n    browser_window_size: BrowserContextWindowSize = field(default_factory=lambda: {'width': 1280, 'height': 1100})\n    no_viewport: Optional[bool] = None\n\n    save_recording_path: str | None = None\n    save_downloads_path: str | None = None\n    trace_path: str | None = None\n    locale: str | None = None\n    user_agent: str = (\n        'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36'\n    )\n\n    highlight_elements: bool = True\n    viewport_expansion: int = 500\n    allowed_domains: list[str] | None = None\n    include_dynamic_attributes: bool = True\n\n    _force_keep_context_alive: bool = False\n```\nThe _is_url_allowed() method is responsible for checking whether a given URL is permitted:\n```python\ndef _is_url_allowed(self, url: str) -> bool:\n    \"\"\"Check if a URL is allowed based on the whitelist configuration.\"\"\"\n    if not self.config.allowed_domains:\n        return True\n\n    try:\n        from urllib.parse import urlparse\n\n        parsed_url = urlparse(url)\n        domain = parsed_url.netloc.lower()\n\n        # Remove port number if present\n        if ':' in domain:\n            domain = domain.split(':')[0]\n\n        # Check if domain matches any allowed domain pattern\n        return any(\n            domain == allowed_domain.lower() or domain.endswith('.' + allowed_domain.lower())\n            for allowed_domain in self.config.allowed_domains\n        )\n    except Exception as e:\n        logger.error(f'Error checking URL allowlist: {str(e)}')\n        return False\n```\nThe core issue stems from the line `domain = domain.split(':')[0]`, which allows an attacker to manipulate basic authentication credentials by providing a username:password pair. By replacing the username with a whitelisted domain, the check can be bypassed, even though the actual domain remains different.\n### Proof of Concept (PoC)\n\nSet allowed_domains to ['example.com'] and use the following URL:\n\nhttps://example.com:pass@localhost:8080\n\nThis allows bypassing all whitelist controls and accessing restricted internal services.\n### Impact\n\n- Affected all users relying on this functionality for security.\n- Potential for unauthorized enumeration of localhost services and internal networks.\n- Ability to bypass domain whitelisting, leading to unauthorized browsing.","summary":"Browser Use's allowed_domains check reads the host from the URL's netloc, so a URL like https://example.com:pass@localhost:8080 passes the whitelist while the browser actually goes to localhost. An attacker who can steer the agent's navigation can reach internal services and browse domains the allowlist was meant to block.","severity":"critical","cvss":9.3,"epss":0.00454,"exploited":false,"exploited_at":null,"products":[{"name":"browser-use","fixed":["0.1.45"],"affected":"<= 0.1.44","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-agents","ai-tooling","browser-use","cwe-647","python","self-hosted"],"not_affected_if":["default-config","network-egress-restricted","no-allowed-domains"],"how_to_check":"- Check the installed version with `pip show browser-use` and see whether it is `0.1.44` or older.\n- Look for `allowed_domains` in your `BrowserContextConfig` or agent config; the bypass only matters if it is set.\n- Search the code for `domain.split(':')[0]` in `browser_use/browser/context.py`.","fix":"- Upgrade `browser-use` to `0.1.45` or later.\n- Until then, do not rely on `allowed_domains` as a security boundary; restrict network egress from the agent host instead.","status":"open","published_at":"2025-05-03T21:15:48+00:00","first_seen_at":"2026-10-27T15:18:30+00:00","triaged_at":"2026-10-27T15:19:07+00:00","updated_at":"2026-10-27T15:32:59+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-10-27T15:19:07Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `browser-use` to `0.1.45` or later.\n- Until then, do not rely on `allowed_domains` as a security boundary; restrict network egress from the agent host instead.","reach":"internet","title":"Browser Use: allowed_domains check bypassed with a decoy domain in URL credentials","impact":"medium","summary":"Browser Use's allowed_domains check reads the host from the URL's netloc, so a URL like https://example.com:pass@localhost:8080 passes the whitelist while the browser actually goes to localhost. An attacker who can steer the agent's navigation can reach internal services and browse domains the allowlist was meant to block.","category":"ai-tooling","nicknames":[],"who_cares":["python","browser-use","ai-agents","self-hosted"],"confidence":0.85,"needs_auth":"no","worst_case":"agent reaches internal localhost services and unauthorized domains","analyst_note":"Confirm the affected/fixed range against the GHSA-x39x-9qw5-ghrf advisory and whether network-layer egress controls mitigate it in practice.","how_to_check":"- Check the installed version with `pip show browser-use` and see whether it is `0.1.44` or older.\n- Look for `allowed_domains` in your `BrowserContextConfig` or agent config; the bypass only matters if it is set.\n- Search the code for `domain.split(':')[0]` in `browser_use/browser/context.py`.","needs_analyst":true,"not_affected_if":["default-config","no-allowed-domains","network-egress-restricted"],"who_is_affected":"Teams running Browser Use with `allowed_domains` set to restrict where the agent may browse, since that check is the thing being bypassed. Deployments that give the agent no domain restriction, or that already isolate it at the network layer, are less exposed to the specific bypass. Anyone who feeds untrusted URLs or pages into the agent should treat it as a real concern.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.0008,"input_tokens":4470,"output_tokens":705,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2025':21A,29A '-47241':22A,30A '-647':44B '0':366C,411C '0.5':200C '1':209C,221C '10.0':270C '1100':237C '1280':235C '5':216C '500':286C '8080':70B,464C '9qw5':26A 'abil':496C 'access':170C,472C 'action':219C 'actual':77B,443C 'affect':477C 'agent':36B,87B,136C,265C 'ai':35B,38B 'ai-ag':34B 'ai-tool':37B 'aliv':301C 'allow':3A,5A,52B,162C,180C,287C,307C,323C,333C,372C,383C,413C,452C,466C 'allowed_domain.lower':378C,381C 'allowlist':98B,397C 'applewebkit/537.36':273C 'arimlabs.ai':110C,111C 'attack':82B,415C 'attribut':295C 'auth':14A 'authent':419C 'base':334C 'basic':418C 'block':102B 'bool':224C,241C,281C,296C,302C,327C 'brows':95B,504C 'browser':1A,32A,41B,49B,76B,116C,155C,226C 'browser-us':40B 'browser-use':31A 'browsercontextconfig':158C,187C 'browsercontextwindows':229C 'bypass':4A,147C,439C,467C,498C 'check':54B,175C,312C,328C,367C,395C,436C 'chrome/85.0.4183.102':277C 'class':159C,186C 'code':108C 'concept':449C 'configur':338C 'context':300C 'control':470C 'cooki':189C 'core':403C 'credenti':420C 'cve':20A,28A 'cwe':43B 'dataclass':185C 'decoy':10A 'def':320C 'default':231C 'defin':160C 'detail':153C 'differ':446C 'disabl':222C 'discov':141C 'domain':6A,11A,53B,96B,163C,171C,288C,342C,354C,363C,364C,369C,373C,377C,384C,387C,409C,434C,444C,453C,499C 'domain.endswith':380C 'domain.split':365C,410C 'download':250C 'dynam':294C 'e':391C,399C 'element':280C 'embed':121C 'enforc':134C 'enumer':489C 'error':394C 'even':440C 'example.com':67B,455C,461C 'except':388C,389C 'expans':284C 'f':393C 'factori':232C 'fals':303C,401C 'field':230C 'file':154C,190C 'float':199C,208C,215C,220C 'follow':459C 'forc':298C 'function':123C,483C 'gecko':276C 'ghrf':27A 'ghsa':24A 'ghsa-x39x-9qw5-ghrf':23A 'given':315C 'goe':78B 'height':236C 'highlight':279C 'host':48B,57B 'howev':138C 'http':13A 'identifi':113C 'idl':204C 'impact':476C 'implic':152C 'import':348C 'includ':119C,293C 'initi':137C 'int':285C 'intend':167C 'intern':92B,474C,494C 'issu':404C 'keep':299C 'khtml':274C 'lambda':233C 'lead':148C,501C 'like':66B,275C 'limit':169C 'line':408C 'list':164C,173C,289C 'load':197C,206C,213C 'local':260C 'localhost':69B,80B,463C,491C 'logger.error':392C 'manipul':417C 'manual':106C 'match':370C 'maximum':210C 'meant':100B 'measur':144C 'method':181C,308C 'minimum':194C 'modul':118C 'mozilla/5.0':267C 'navig':89B,183C 'netloc':62B 'network':203C,495C 'none':192C,193C,242C,247C,248C,253C,254C,258C,259C,262C,263C,291C,292C 'nt':269C 'number':358C 'option':240C 'page':196C,205C,212C 'pair':426C 'pars':350C 'parsed_url.netloc.lower':355C 'pass':68B,71B,462C 'password':425C 'path':245C,251C,256C 'pattern':374C 'permit':318C 'poc':450C 'port':357C 'portion':16A 'potenti':486C 'present':360C 'proof':447C 'provid':422C 'put':8A 'python':45B,184C,319C 'reach':91B 'read':55B 'record':244C 'reli':480C 'remain':445C 'remov':356C 'replac':428C 'research':112C 'respons':310C 'restrict':125C,132C,473C 'return':343C,375C,400C 'review':109C 'safari/537.36':278C 'save':243C,249C 'secur':151C,223C,485C 'self':47B,324C 'self-host':46B 'self.config.allowed':341C,386C 'servic':93B,475C,492C 'set':451C 'sever':150C 'size':228C 'sourc':107C 'steer':85B 'stem':405C 'str':191C,246C,252C,257C,261C,266C,290C,326C,398C 'strip':188C 'summari':103C 'though':441C 'time':198C,207C,214C 'tool':39B 'trace':255C 'tri':345C 'true':225C,282C,297C,344C 'unauthor':488C,503C 'url':19A,60B,65B,126C,179C,306C,316C,322C,325C,331C,351C,353C,396C,460C 'urllib.parse':347C 'urlpars':349C,352C 'use':2A,33A,42B,50B,117C,457C 'use/browser/context.py':156C 'user':264C,479C 'usernam':15A,424C,430C 'viewport':239C,283C 'visit':130C 'wait':195C,201C,211C,217C 'whether':313C 'whitelist':73B,122C,337C,433C,469C,500C 'width':234C 'win64':271C 'window':227C,268C 'x39x':25A 'x64':272C","nicknames":[],"mitigations":[],"who_affected":"Teams running Browser Use with `allowed_domains` set to restrict where the agent may browse, since that check is the thing being bypassed. Deployments that give the agent no domain restriction, or that already isolate it at the network layer, are less exposed to the specific bypass. Anyone who feeds untrusted URLs or pages into the agent should treat it as a real concern.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2025-05-03T21:15:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-x39x-9qw5-ghrf","url":"https://github.com/advisories/GHSA-x39x-9qw5-ghrf","severity":"critical","published_at":"2025-05-05T18:25:04+00:00","modified_at":"2026-10-27T15:15:28+00:00","first_seen_at":"2026-10-27T15:18:30+00:00","fetched_at":"2026-10-27T15:18:30+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-47241","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47241","severity":null,"published_at":"2025-05-03T21:15:48+00:00","modified_at":"2026-06-17T09:27:37+00:00","first_seen_at":"2026-10-27T15:32:59+00:00","fetched_at":"2026-10-27T15:32:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}