PraisonAI Browser Server: Unanchored Regex Lets Attackers Bypass Origin Check, Hijack Chrome Extension Sessions

A GitHub Security Advisory (GHSA-6g6r-q6gw-w8fg, CVE-2026-55536, CVSS 9.1) reports a patch bypass in PraisonAI's browser automation server (praisonai/browser/server.py). According to the advisory, the WebSocket handler validates the Origin header of incoming connections using re.match(r"chrome-extension://[a-z0-9]{32}", origin). Because re.match() only anchors at the start of the string, an Origin header with 33 or more characters after chrome-extension:// still matches — trailing characters are never checked. The advisory states this is the only access-control gate before websocket.accept(), with no bearer token, API key, or extension-ID allowlist behind it. It's described as a bypass of a prior fix (GHSA-8x8f-54wf-vv92 / CVE-2026-40289), which added the origin check in the first place. A public PoC is included in the advisory. This is a fresh, developing report and has not been independently verified beyond the source material.

Why it matters

Per the advisory, once a connection is accepted, an attacker can send a start_session command that any connected Chrome extension will execute, triggering arbitrary browser automation — including cookie exfiltration from open tabs and screenshot capture. In the default configuration (bound to 127.0.0.1), the advisory notes this is reachable by any local process, including malicious code in a compromised dependency or via localhost SSRF. If the server is run with PRAISONAI_BROWSER_ALLOW_REMOTE=true, it's exposed on 0.0.0.0:8765 with only this bypassable regex standing between an unauthenticated remote attacker and full browser control — potentially exposing sessions for email, banking, or corporate SSO the victim is logged into.

What defenders should do now

• Inventory whether PraisonAI's browser server component is deployed anywhere in your environment, and check whether PRAISONAI_BROWSER_ALLOW_REMOTE is set — remote-exposed instances are the highest priority.
• Until a fix is confirmed available, restrict network access to the browser server's port (default 8765) to trusted local processes only; do not expose it beyond localhost.
• Hunt for unexpected WebSocket connections to the browser server port, especially from processes other than the expected Chrome extension, and for outbound start_session/start_automation traffic with unusual goal parameters.
• Watch for anomalous browser automation behavior — unexpected tab activity, cookie access patterns, or screenshot-taking — correlated with this service running.
• Track for an upstream patch; the advisory's suggested remediation is switching to re.fullmatch() with the correct Chrome extension ID character set (a-p, 32 chars).

This is early-stage, single-source intel from a GitHub Security Advisory published today; details may evolve as the maintainers respond. See the original advisory for full technical detail and PoC: GHSA-6g6r-q6gw-w8fg.