Description

browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions. Attackers with read access to the temporary settings directory can recover provider API keys from predictably-named JSON files.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-30T14:17:03.890Z",
  "pubdate": "2026-08-30T14:17:03.890Z",
  "executiveSummary": "The browser-use web-ui application, specifically versions 2.0.0 through 3.0.0, contains a critical security flaw involving the insecure storage of sensitive credentials. The application persists configured LLM provider API keys to local disk storage in cleartext format.\nThis vulnerability constitutes an Improper Neutralization of Sensitive Information and a failure to implement cryptographic protections for sensitive data at rest. By default, these files are written to a predictable directory without restrictive file system permissions, effectively exposing credentials to any user or malicious process with read access to the underlying host system.\nThe risk implication is severe; an attacker capable of local file system access can retrieve these keys, leading to potential unauthorized use of paid LLM services, account takeover, or the exfiltration of proprietary data processed through those LLM endpoints. Exploitation requires no specific privileges beyond the ability to read files in the application's temporary settings directory, significantly lowering the barrier for potential threats.",
  "technicalDetails": "The root cause of this vulnerability lies in the application's configuration management logic within the browser-use web-ui architecture (versions 2.0.0 through 3.0.0). When users configure LLM provider settings via the interface, the application serializes these parameters into JSON-formatted configuration files stored in the local temporary settings directory.\nThe implementation lacks any form of encryption, obfuscation, or secure enclave integration. Consequently, sensitive data, specifically API keys used for authentication with various LLM providers, are written directly to the file system as plaintext strings. Furthermore, the file system operations do not explicitly set restrictive access control lists (ACLs) or Linux file permissions (e.g., 600 chmod) upon creation, leaving these files readable by any user account sharing the same environment or any process running with the same or higher privilege level.\nThe attack flow for this vulnerability is straightforward. First, an adversary gains initial access to the target host through secondary means, such as local shell access, a compromised user account, or via a directory traversal vulnerability that allows reading from the temporary settings directory. Second, the attacker locates the predictably named JSON configuration files within the browser-use web-ui workspace. Third, the attacker reads the file contents, extracting the cleartext API keys for the configured services.\nPost-exploitation impact includes the total loss of confidentiality for the stored API credentials. Because these keys are often tied to specific user accounts with billing capabilities, attackers can perform unauthorized service consumption, resulting in financial theft or exhaustion of rate limits. Additionally, if the keys are used in conjunction with other integrated services, the attacker may pivot through the LLM infrastructure to access further internal data or perform actions on behalf of the victim.\nThe vulnerability persists throughout the full lifecycle of the configuration file. Unless the application is patched to implement secure storage—such as utilizing OS-level secret stores (e.g., libsecret, Keychain, or Windows Credential Manager) or encrypting the configuration file using a key derived from an authenticated user session—the sensitive data remains permanently exposed at rest."
}