playwright-mcp

microsoft/playwright-mcp

Playwright MCP is an official Microsoft MCP server that lets AI agents control a web browser using Playwright accessibility snapshots. Its biggest risk is that it enables the browser_run_code_unsafe tool by default, which executes arbitrary JavaScript in the host Node.js process and allows a prompt injection on any visited webpage to run code on the user's machine.

What it can reach

Browser

Launches and controls Chrome, Firefox, WebKit, or Edge with persistent or isolated profiles, or connects to an existing browser via extension or CDP.

Network

Can navigate to any URL on the internet or local network by default, inspect network traffic, and optionally listen on a local HTTP port for MCP connections.

Files

Reads and writes files within the workspace root (or anywhere on disk if --allow-unrestricted-file-access is set) for file uploads, screenshots, PDFs, storage state, and tool outputs.

Shell commands

Executes arbitrary JavaScript in the host Playwright Node.js server process via the default browser_run_code_unsafe tool and optional --init-page scripts.

Secrets

Can read a configured dotenv secrets file (--secrets) and access cookies, localStorage, and sessionStorage in the browser profile.

Findings

1. HighHost code execution tool (browser_run_code_unsafe) is enabled by default

   README.md:1084

   The default core toolset exposes browser_run_code_unsafe, which executes arbitrary JavaScript inside the Playwright server process on the host machine rather than inside the browser tab. Because the agent uses this server to read untrusted web pages, a prompt injection on a visited site can instruct the agent to call browser_run_code_unsafe and achieve full remote code execution on the user's computer.

   Fix: Disable or require explicit human confirmation for browser_run_code_unsafe in your MCP client configuration, or run the MCP server inside an isolated container.

2. MediumVisited web pages can register MCP tools by default via WebMCP

   config.d.ts:148

   Unless disabled with --no-webmcp, the server automatically collects and exposes MCP tools that any visited web page registers through the experimental WebMCP API. A malicious website can register tools with deceptive names or prompt-injected descriptions to hijack the AI agent.

   Fix: Pass --no-webmcp in the server arguments or set the environment variable PLAYWRIGHT_MCP_WEBMCP=false when browsing untrusted sites.

3. MediumWorkspace files can be uploaded or overwritten through browser tools

   config.d.ts:265

   Even when allowUnrestrictedFileAccess is not enabled, tools such as browser_file_upload, browser_drop, and the filename output parameter on several tools can read and write files anywhere inside the workspace root. A prompt injection on a webpage could trick the agent into uploading sensitive workspace files (like .env or source code) to an attacker's site or overwriting project files.

   Fix: Run the server from a dedicated empty directory rather than a sensitive project workspace, and restrict reachable domains with --allowed-origins.

4. MediumDocker image disables the Chromium sandbox by default

   Dockerfile:80

   The Docker entrypoint launches Chromium with --no-sandbox, turning off the browser's OS-level process isolation when rendering untrusted web content. Additionally, the README's long-running Docker service example passes --host 0.0.0.0 on port 8931, which exposes the unauthenticated MCP server to the network if used without firewall restrictions.

   Fix: Bind network ports to 127.0.0.1 instead of 0.0.0.0, and configure container seccomp/user-namespace permissions so Chromium can run without --no-sandbox.