Conversation
Network.clearBrowserCookies is not scoped to the calling tab. Through
chrome.debugger it clears every cookie for every domain in the user's Chrome
profile, signing them out of mail, source control and banking at once. The
relay forwarded it: it is not in INIT_ONLY_METHODS and was intercepted
nowhere, so it fell through _forwardToTab to the extension. Same for
Network.clearBrowserCache and Storage.clearCookies. Chrome offers no scoped
variant of any of them.
The exposure is structural to this product rather than incidental. Tools that
drive a throwaway Chromium lose a temp profile; BrowserForce advertises the
user's real profile to every connected CDP client by design, so the blast
radius is the whole browser.
The guard sits in _handleCdpClientMessage before routing, because these
commands arrive on both paths: tab-scoped with a sessionId (Network.*) and
browser-scoped without one (Storage.clearCookies). It reads the permission
through _getRestrictionsSafe(), so an unreadable setting refuses rather than
defaulting to granted.
The opt-in is a popup checkbox, not an env var. An agent runs shell commands
and could export an env var for itself; it cannot tick a checkbox. Scoped
operations stay allowed and the refusal names them, so an agent recovers
without asking the user at all: Network.getCookies + Network.deleteCookies for
one site, Storage.clearDataForOrigin for one origin.
Tests drive the real Playwright path — auto-attach, then issue the command
against the page session id. Sent without a sessionId these reach the
browser-level handler, which answers {} for anything it does not know, so such
a test would pass with or without the guard. Verified red by removing the
guard: the three refusals and the fail-closed case fail, while the two
must-still-work cases stay green.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019jMKr1zqWLLffD5h1vhwMH
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The hole
Network.clearBrowserCookiesis not scoped to the calling tab. Throughchrome.debuggerit clears every cookie for every domain in the user's Chrome profile — mail, source control, banking, all at once.The relay forwarded it. It is not in
INIT_ONLY_METHODSand was intercepted nowhere, so it fell through_forwardToTab→_sendToExt('cdpCommand')→chrome.debugger.sendCommand. Same forNetwork.clearBrowserCacheandStorage.clearCookies. Chrome offers no scoped variant of any of them.The exposure is structural to this product, not incidental: a tool driving a throwaway Chromium loses a temp profile, while BrowserForce advertises the user's real profile to every connected CDP client by design. Our core value proposition is the blast radius.
Not hypothetical — a competitor shipped this, hit it, and wrote it up: "It wiped Gmail, GitHub, and all authenticated sessions."
The fix
A
PROFILE_WIDE_CLEAR_METHODSguard in_handleCdpClientMessage, before routing — these arrive on both paths: tab-scoped with a sessionId (Network.*) and browser-scoped without one (Storage.clearCookies).Permission is read through
_getRestrictionsSafe(), so an unreadable setting refuses rather than defaulting to granted.The opt-in is a popup checkbox, not an env var. An agent runs shell commands and could export an env var for itself; it cannot tick a checkbox. Default off.
Scoped operations stay allowed, and the refusal names them so an agent recovers without interrupting the user:
Tests — and why the first draft was wrong
6 new tests. The first version sent these commands without a sessionId, which routes to the browser-level handler that answers
{}for anything it doesn't know. Those tests would have passed with or without the guard. Rewritten to drive the real Playwright path: auto-attach, then issue against the page session id.Verified red by removing the guard: the three refusals and the fail-closed case fail; the two must-still-work cases stay green — correct polarity in both directions.
pnpm test— 995 tests, 0 failures, exit 0 (was 989)Docs
[DOCS UPDATED: AGENTS.md (Security Rules), skills/browserforce/SKILL.md (Rules #6)]🤖 Generated with Claude Code
https://claude.ai/code/session_019jMKr1zqWLLffD5h1vhwMH