Playwright 1.64.1 includes Chromium without the patches for four vulnerabilities that Chrome has already fixed, a combination that could expose your computer if an AI agent uses the tool to visit malicious pages. The problem cannot be resolved simply by updating Playwright: according to RedesZone, the latest version of the package still includes a vulnerable browser build.
Playwright lets you automate a browser: a program can open pages, fill out forms, click buttons, take screenshots, or download files. This capability is also useful for AI agents that browse the Internet and extract information. The risk arises when an agent reaches a hostile site and the browser it uses has security flaws.
A recent package version is not enough
RedesZone identifies four vulnerabilities: CVE-2026-118306, CVE-2026-118331, CVE-2026-118348, and CVE-2026-118344. Chrome released fixes for these flaws the week before the alert, in versions 156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 for Linux. The build included in Playwright predates those updates.
The detail matters because Playwright distributes its own browser versions. The project's documentation explains that each Playwright version requires specific browser binaries and that the package can use Chromium instead of commercial Chrome. Therefore, keeping Playwright up to date does not guarantee that the Chromium it installs is the patched build.
The description of issue #43664 on GitHub states that Playwright 1.64.1 and its Docker image include Chromium 156.0.8078.4, while Chrome for Testing 156.0.8078.47 fixes the flaws flagged by the scanner mentioned in the request. The description says the tool detected 245 CVEs—24 critical and 221 high—in that image, and that all were fixed in build .47. These figures come from the request published in the repository, not from an independent assessment of all Playwright deployments.
“And the Playwright SANDBOX IS OFF BY DEFAULT”
— nisten
The sandbox changes the scope of the risk
Nisten's warning, posted on X on November 2, also focuses on isolation. RedesZone notes that Playwright's sandbox is disabled by default. This barrier separates the browser from the operating system: without it, an exploit launched from a page could operate with the process's privileges and access, for example, the user's files.
The usage context makes a difference. Running Playwright to test your own website is not the same as giving an agent the freedom to browse third-party sites, where it may encounter malicious content. In the latter scenario, the automated browser can become a path to data available on the machine running it.
The recommendation shared by nisten is to remove Playwright from AI agents for now. They also suggest using Chrome with the sandbox enabled, running browsing agents in a virtual machine without real credentials, and pinning tool versions. RedesZone presents these measures as mitigations while the discrepancy between the included Chromium version and the patched version persists.
On GitHub, the request to update the Docker image progressed after it was opened: a related change was incorporated into the repository, and the issue was closed as completed on October 30. The activity describes a change so that Docker builds select the stable version of Chrome for Testing; it does not, by itself, confirm the release of a 1.64.x version with the patched Chromium. For now, the practical step for those using agents is to check which binary they run and whether the browser is isolated.
Sources: RedesZone, GitHub, Debian Security Tracker, Playwright
