Browser Use allows bypassing `allowed_domains` by putting a decoy domain in http auth username portion of a URL
SummaryDuring a manual source code review, [**ARIMLABS.AI**](https://arimlabs.ai) researchers identified that the `browser_use` module includes an embedded whitelist functionality to restrict URLs that can be visited. This restriction is enforced during agent initialization. However, it was discovered that these measures can be bypassed, leading to severe security implications.Details**File:** `browser_use/browser/context.py`The `BrowserContextConfig` class defines an `allowed_domains` list, which is intended to limit accessible domains. This list is checked in the `_is_url_allowed()` method before navigation:The _is_url_allowed() method is responsible for checking whether a given URL is permitted:The core issue stems from the line `domain = domain.split(':')[0]`, which allows an attacker to manipulate basic authentication credentials by providing a username:password pair. By replacing the username with a whitelisted domain, the check can be bypassed, even though the actual domain remains different.Proof of Concept (PoC)Set allowed_domains to ['example.com'] and use the following URL:https://example.com:pass@localhost:8080This allows bypassing all whitelist controls and accessing restricted internal services.ImpactAffected all users relying on this functionality for security.Potential for unauthorized enumeration of localhost services and internal networks.Ability to bypass domain whitelisting, leading to unauthorized browsing.