Brief · Builders

Your Playwright Chromium Is Older Than Your Chrome

By alkizz · Oct 30, 2026

Posts going around today imply a Chrome sandbox escape was fixed in 156, claim it's a full chain, and say the stale Chromium your Playwright scripts download is exposed. The stale-Chromium part is the one worth your time, just not quite for the reason given, so here's a follow-up to this morning's piece on the browsers built into AI coding tools.

What the escape actually is

The bug is CVE-2026-106378, rated Medium, Mac-only and fixed in Chrome 155.0.8059.39 on Oct 6, not in 156. Google didn't say it was exploited, and it isn't in CISA's KEV catalog. It's also one stage of a chain, since attackers need to have "compromised the renderer process" first. PWN.AI's proof of concept patched Chromium's source to stand in for that step before injecting keystrokes to launch Calculator, and we found no published full chain.

Chrome 156 is a separate story, with 52 security fixes on Oct 27 (156.0.8078.73) and 21 more on Oct 29 (156.0.8078.79), none marked as exploited.

The bundled browsers are pinned

Playwright and Puppeteer don't use the Chrome that updates itself. "Each version of Playwright needs specific versions of browser binaries," per its docs, and Puppeteer pins its own too, so the browser only moves when you update the package and reinstall. The latest Playwright, 1.64.1, bundles Chromium 156.0.8078.4, a pre-stable build, and Puppeteer 25.16.0 bundles 156.0.8078.47. Both have the 106378 fix, but neither has the Oct 27 or 29 fixes. Older pins like Playwright 1.62.1 (Chromium 151) and 1.63.0 (153) predate even the 106378 fix.

The part the post missed

Playwright's docs say its chromiumSandbox launch option "Defaults to false", and the launcher adds --no-sandbox whenever it isn't set to true. So a plain Playwright script that doesn't opt in runs without Chrome's sandbox, and one renderer bug is enough to run code as you, no escape needed. That's the library default, though, and Playwright's MCP server defaults to your installed Chrome with the sandbox on, though on Linux it's off if you switch it to the bundled Chromium.

Where Accessibility fits

On macOS, a process inherits the privacy permissions of the app that launched it, like your terminal or IDE. PWN.AI's trick worked because Chrome's GPU process inherited those grants, and the fix makes it give them up, though the main browser process still inherits. Apple says Accessibility lets an app "access and control your Mac." My read is that this raises the stakes if code gets out, adding keyboard and UI control on top of running as you, but on its own it doesn't let anything in.

The score

I'd call it a 3, patch normally. Nothing here is known to be exploited, and the viral escape needs another bug first. But if your scripts point bundled Chromium at pages you don't control, an old build with no sandbox is a real gap, and it's cheap to close.

What to do:

• Update the bundled browsers.

  • Why: they're pinned to the package version, so updating Chrome doesn't touch them.
  • How: update playwright and run npx playwright install, and for Puppeteer update the package and run npx puppeteer browsers install. Neither latest build has the Oct 27 and 29 fixes, so my read is to point scripts that browse untrusted pages at your updated Chrome with Playwright's channel: 'chrome' for now.

• Check which versions you actually have.

  • Why: each project pins its own, so what's on disk may surprise you.
  • How: npx playwright install --list lists browsers from every Playwright install on the machine, which by default live in ~/Library/Caches/ms-playwright on macOS and ~/.cache/ms-playwright on Linux. For Puppeteer, run npx @puppeteer/browsers list --path ~/.cache/puppeteer. On a Mac, anything below 155.0.8059.39 predates the 106378 fix, and anything below 156.0.8078.79 lacks some or all of the Oct 27 and 29 fixes.

• Don't disable the sandbox.

  • Why: without it, one renderer bug is code execution as you, and every page a script loads is untrusted input (builders item 10).
  • How: pass chromiumSandbox: true to Playwright's launch(), and search your scripts and MCP configs for --no-sandbox. If a CI box really can't run the sandbox, my read is to treat it as disposable and keep secrets off it (builders item 4).

• Check which apps have Accessibility access.

  • Why: an app with it can control your Mac, and processes it launches can inherit that.
  • How: Apple menu > System Settings > Privacy & Security > Accessibility, then switch off terminals and editors that don't need it.

Sources

• CVE.org: CVE-2026-106378
• NVD: CVE-2026-106378
• Google: Stable Channel Update for Desktop, Chrome 155 (Oct 6, 2026)
• Google: Chrome Releases, Chrome 156.0.8078.73 (Oct 27, 2026)
• Google: Chrome Releases, Chrome 156.0.8078.79 (Oct 29, 2026)
• CISA: Known Exploited Vulnerabilities catalog (JSON)
• PWN.AI: Chrome escape write-up
• Playwright: Browsers
• Playwright: BrowserType launch options (chromiumSandbox)
• Playwright: chromium.ts launcher source, v1.64.1
• Playwright: playwright-core 1.64.1 browsers.json
• Playwright: playwright-core 1.62.1 browsers.json
• Playwright: v1.63.0 release notes
• Playwright MCP: README (0.0.83)
• Playwright MCP: browser config defaults (playwright-core 1.64.0-alpha-1790635538000, validateBrowserConfig)
• Puppeteer: v25.16.0 release
• Puppeteer: puppeteer-core 25.16.0 revisions.js
• Puppeteer: Installation
• Puppeteer: Configuration
• Puppeteer: @puppeteer/browsers
• Qt: The Curious Case of the Responsible Process (Feb 4, 2022)
• Chromium: gpu_process_host.cc, GPU process disclaims TCC responsibility (156.0.8078.47)
• Apple: Allow accessibility apps to access your Mac

← All briefs