CVE-2026-84833 in openbrowser
Summary
by MITRE • 09/02/2026
A vulnerability was found in ntegrals openbrowser up to 067fc45d649baa961750da8e2f4a75d87c5c75c8. Affected by this vulnerability is an unknown functionality of the file packages/core/src/agent/agent.ts of the component Browser Agent Message Construction. Performing a manipulation results in resource consumption. It is possible to initiate the attack remotely. The exploit has been made public and could be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified within the ntegrals openbrowser project, specifically affecting versions up through commit 067fc45d649baa961750da8e2f4a75d87c5c75c8, represents a significant security risk due to its potential for remote exploitation and the resulting resource consumption. This flaw resides within the Browser Agent Message Construction functionality, located in the source file packages/core/src/agent/agent.ts. The core issue involves an improper handling of input or message construction logic that allows an attacker to trigger excessive resource usage on the target system. Because this component is responsible for constructing messages between agents and browsers, any manipulation of these inputs can lead to a denial-of-service condition by exhausting CPU cycles, memory, or network bandwidth associated with processing malformed or maliciously crafted requests.
From a technical perspective, this vulnerability aligns closely with CWE-400, which describes Uncontrolled Resource Consumption. The flaw likely stems from insufficient validation or rate limiting mechanisms when constructing agent messages. An attacker can exploit this by sending specially crafted payloads that force the application into infinite loops, excessive recursive calls, or heavy computational tasks without corresponding safeguards to limit resource allocation. This type of vulnerability is particularly dangerous in web-based applications where agents interact with browsers, as it allows for remote exploitation over standard network protocols such as HTTP or WebSocket connections. The fact that the exploit has been made public significantly increases the risk landscape, enabling less sophisticated threat actors to launch attacks against vulnerable instances without needing custom tooling.
The operational impact of this vulnerability is primarily centered on service availability and system stability. By consuming excessive resources, an attacker can render the application unresponsive or cause it to crash, effectively achieving a denial-of-service state for legitimate users. In environments where continuous delivery via rolling releases is employed, as noted in the vendor's release model, patching becomes more complex because there are no discrete version numbers to target for updates. This lack of fixed version identifiers means that administrators cannot simply upgrade to a specific patched release; instead, they must monitor commit history or rely on direct vendor communication for remediation guidance. The absence of response from the vendor since early contact further exacerbates this issue, leaving users without official mitigation strategies and forcing them to implement workarounds such as network-level filtering, input validation at proxy layers, or resource limits via container orchestration tools like Kubernetes or Docker.
To mitigate these risks in the interim, organizations should focus on defense-in-depth strategies since a direct code patch is unavailable due to the rolling release nature of the software and lack of vendor engagement. Implementing strict rate limiting on endpoints that handle agent messages can help throttle malicious traffic before it triggers resource exhaustion. Additionally, deploying Web Application Firewalls with rules designed to detect anomalous message sizes or patterns associated with this specific vulnerability can provide a layer of protection. It is also advisable to isolate the affected components within containers with restricted CPU and memory limits to contain any potential impact from successful exploitation. Monitoring system metrics for unusual spikes in resource usage correlated with incoming requests can aid in early detection of active attacks, allowing security teams to respond promptly despite the lack of an official vendor patch.