CVE-2026-40289

The browser bridge server starts by default on address 0.0.0.0 (all network interfaces) and listens for WebSocket connections on the /ws endpoint without requiring any authentication. The only form of verification is checking the Origin header; however, this mechanism is active only when the header is present in the request – a non-browser client (e.g., a script or network tool) can simply omit this header, and the server will accept the connection without restrictions. The attacker sends a start_session message, and the server directs it to the first available browser extension session, effectively taking control of that session. Any automation actions and output data are then transmitted back to the attacker.

Attackers gain unauthorized remote control over browser automation sessions, leading to leakage of sensitive data from visited page contexts and automation results, and enabling misuse of browser actions supported by AI models.

Update PraisonAI to version 4.5.139 or newer and praisonaiagents to version 1.5.140 or newer. Until the update is applied, it is recommended to restrict network access to the browser bridge port using a firewall or limit listening only to the localhost interface (127.0.0.1).

PraisonAI in versions below 4.5.139 and praisonaiagents in versions below 1.5.140