Vulnerability · Published Jun 21, 2026 · Assigned by VulDB
CVE-2026-12823Browserbase Skills Autobrowse Trace Artifact default permission
Low 3.3
In plain English
A low-severity incorrect default permissions in Skills from Browserbase. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).
Official description
A security flaw has been discovered in Browserbase Skills up to 20260526. This impacts an unknown function of the component Autobrowse Trace Artifact Handler. The manipulation results in incorrect default permissions. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The first version of the CVE listed Browserbase itself as affected product. This was incorrect as this issue does affect browserbase/skills instead. The vendor was contacted early about this disclosure.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Browserbase | Skills | 20260526 |
Weakness: CWE-276, CWE-266 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
References
- VDB-372613 | Browserbase Skills Autobrowse Trace Artifact default permission vdb-entry
- VDB-372613 | CTI Indicators (IOB, IOC, TTP) signature, permissions-required
- CVE-2026-12823 | CVE Analysis and Report third-party-advisory
- Submit #837600 | Browserbase Browserbase Skills latest main branch prior to fix (tested May 2026) Information Disclosure / Insecure File Permissions third-party-advisory
- https://github.com/NARKHEDE-VAIBHAV/poc/blob/main/CVE-2026-12823%20-%20Browserbase%20Skills%20Autobrowse%20Trace%20Artifact%20Insecure%20File%20Permissions/Advisory.md exploit
- https://github.com/NARKHEDE-VAIBHAV/poc/blob/main/CVE-2026-12823%20-%20Browserbase%20Skills%20Autobrowse%20Trace%20Artifact%20Insecure%20File%20Permissions/poc.sh exploit