Chrome sandbox escape still lurks in cached Playwright Chromium inheriting your IDE's macOS permissions
flngr · x · 2026-10-31
A security warning for macOS AI coding toolchains: even with Chrome auto-updated to 156, the risk persists.
The attack chain:
- Your IDE or terminal running Cursor, Claude Code, or a shell holds macOS Accessibility permissions;
- It spawns a cached Playwright/Puppeteer Chromium (typically stuck on v131–151);
- That browser inherits the IDE's Accessibility permission;
- Any site your agent visits can abuse the GPU process to press Cmd+Space, open Terminal, and run arbitrary commands — full remote code execution.
Mitigation: check /Library/Caches/ms-playwright and /.cache/puppeteer now, and update to Playwright 1.64.1+ (Chromium 156). A novel attack surface combining a Chrome sandbox escape with MCP browser tools.
More from coding & agent
- Codebases are becoming organic: devs say AI-era engineering needs cybernetics-style abstractions — JensHonack · 2026-10-31
- Codex power user shows 71.5B lifetime tokens and a 262-day daily streak — TheMoonMidas · 2026-10-31
- Dev Asks GPT-6 Astra to Motorize an Office Chair, Then Builds It in Real Life — sdand · 2026-10-31
- Dev builds DeepSeek-powered agent to mine GTA6 scavenger hunt clues into a map app — MicahBerkley · 2026-10-31
- Anthropic Rewrote Its Messages API in Rust With Zero Rust Devs, CPU Down 40-50% — kieranklaassen · 2026-10-31
- MiniMax M3.1 Flash Builds Playable Arcade Game in 17 Minutes for 15 Cents — omarsar0 · 2026-10-31