---
id: CVE-2026-12823
title: A security flaw has been discovered in Browserbase Skills up to 20260526
summary: >-
  A security flaw has been discovered in Browserbase Skills up to 20260526. This
  impacts an unknown function of the component Autobrowse Trace Artifact
  Handler. The manipulation results in incorrect default permissions. The attack
  requires…
severity: low
cvss: 3.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-266
  - CWE-276
published: '2026-06-22'
updated: '2026-07-03'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-12823'
references:
  - url: >-
      https://github.com/NARKHEDE-VAIBHAV/poc/blob/main/CVE-2026-12823%20-%20Browserbase%20Skills%20Autobrowse%20Trace%20Artifact%20Insecure%20File%20Permissions/Advisory.md
    label: cna@vuldb.com
  - url: >-
      https://github.com/NARKHEDE-VAIBHAV/poc/blob/main/CVE-2026-12823%20-%20Browserbase%20Skills%20Autobrowse%20Trace%20Artifact%20Insecure%20File%20Permissions/poc.sh
    label: cna@vuldb.com
  - url: 'https://vuldb.com/cve/CVE-2026-12823'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/837600'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/372613'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/372613/cti'
    label: cna@vuldb.com
tags:
  - nvd
epss: 0.0016
epssPercentile: 0.04459
ingestedAt: '2026-07-03T13:02:27.812Z'
---

## Overview

A security flaw has been discovered in Browserbase Skills up to 20260526. This impacts an unknown function of the component Autobrowse Trace Artifact Handler. The manipulation results in incorrect default permissions. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The first version of the CVE listed Browserbase itself as affected product. This was incorrect as this issue does affect browserbase/skills instead. The vendor was contacted early about this disclosure.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.