Description

A vulnerability was found in ntegrals openbrowser up to 067fc45d649baa961750da8e2f4a75d87c5c75c8. Affected by this vulnerability is an unknown functionality of the file packages/core/src/agent/agent.ts of the component Browser Agent Message Construction. Performing a manipulation results in resource consumption. It is possible to initiate the attack remotely. The exploit has been made public and could be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-02T18:21:33.370Z",
  "pubdate": "2026-09-02T18:21:33.370Z",
  "executiveSummary": "A resource consumption vulnerability exists within the ntegrals openbrowser component, specifically residing in the Browser Agent Message Construction module.\nThe vulnerability is located in the file packages/core/src/agent/agent.ts and affects all commits up to 067fc45d649baa961750da8e2f4a75d87c5c75c8.\nThe flaw allows for a remote denial-of-service (DoS) condition by inducing excessive resource usage during the message construction phase.\nAs the project utilizes a rolling release model, there are no specific version numbers for patches, and the vendor has remained unresponsive to disclosure efforts.\nExploitation is possible remotely without requiring prior authentication, posing a significant risk to service availability.\nPublicly available exploit code increases the likelihood of malicious actors leveraging this vulnerability to disrupt service operations through resource depletion.",
  "technicalDetails": "The vulnerability is localized within the Browser Agent Message Construction logic, specifically implemented in packages/core/src/agent/agent.ts. The root cause pertains to improper handling of incoming messages or data structures during the construction phase, which triggers unbounded resource consumption.\nIn the context of the openbrowser architecture, the Browser Agent is responsible for interpreting and constructing communication packets to facilitate browser automation. The vulnerability allows an attacker to transmit maliciously crafted payloads that force the agent to enter an intensive processing loop or allocate disproportionate amounts of memory or CPU cycles.\nThe attack flow initiates when an unauthenticated remote attacker sends a specifically formatted request to the agent's message interface. The agent's logic in agent.ts fails to implement sufficient input validation or resource constraints on these messages. Upon receipt, the application attempts to process the payload; the flaw causes the system to consume system resources until the process hits a limit or triggers a system-wide performance degradation, resulting in a denial-of-service condition.\nBecause the vulnerability is embedded in the core message construction logic, the impact is comprehensive. By saturating the CPU or memory resources assigned to the agent, the attacker effectively disables the browser automation capabilities of the system. Given that the component is exposed to remote input, no elevated privileges are required to initiate this attack sequence, making it highly accessible to external threats.\nThe exploitation does not require interaction from a legitimate user and can be automated. Post-exploitation, the agent remains in an unstable or unresponsive state until manual intervention, such as a process restart, is performed. The lack of proper validation on the incoming message structure prevents the agent from rejecting malformed or malicious inputs, leading to the exhaustion of host resources. The absence of vendor-provided security patches necessitates manual analysis and code-level remediation by administrators to prevent exploitation in production environments."
}