T09 · Insecure Skill Coding Practices
- Location
process_briefing.py:45- Finding
Chrome Sandbox Disabled While Rendering Input HTML
- Content
View full analysis
Vulnerability Details
File Location:
process_briefing.py, lines 45–52
Vulnerability Type: Unsafe browser security configuration
Risk Level: MediumVulnerable Code
python cmd = [ chrome, "--headless", "--disable-gpu", "--no-sandbox", "--hide-scrollbars", "--screenshot=" + output_path, f"--window-size={SCREENSHOT_W},{SCREENSHOT_H}", f"--virtual-time-budget={VIRTUAL_TIME}", "file://" + os.path.abspath(html_path), ]Technical Analysis
The script launches headless Chrome with the
--no-sandboxoption when rendering the supplied HTML file. This disables Chrome's operating-system-level process isolation and substantially weakens containment of the renderer.The script accepts the HTML path as a command-line argument and does not validate or sanitize the document before opening it. HTML can contain active content and references to external resources. An attacker who can provide or influence the rendered document could therefore expose the browser to malicious markup, scripts, fonts, images, or remote content.
Malicious HTML alone does not automatically provide host code execution; successful host compromise would generally require a compatible Chrome vulnerability. However, if such a renderer or browser exploit succeeds, disabling the sandbox removes an important defense-in-depth boundary and can allow the exploit to operate with the privileges of the account running this skill.
The command is constructed as an argument list and executed without a shell, so the reviewed code does not expose shell command injection through these arguments.
Attack Path
- An attacker supplies or influences the briefing HTML processed by the skill.
- The HTML embeds malicious active content or loads a crafted browser resource.
- The script opens the document in headless Chrome with
--no-sandbox. - The content exploits a compatible vulnerability in the installed Chrome version.
- Because Chrome's sandbox is dis ...[truncated 710 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
--no-sandboxand run Chrome with its standard sandbox enabled:
python cmd = [ chrome, "--headless", "--disable-gpu", "--hide-scrollbars", "--screenshot=" + output_path, f"--window-size={SCREENSHOT_W},{SCREENSHOT_H}", f"--virtual-time-budget={VIRTUAL_TIME}", "file://" + os.path.abspath(html_path), ]- Run the renderer as a dedicated, unprivileged operating-system account with no access to credentials or unrelated user files.
- Execute rendering inside a hardened container or equivalent isolation boundary with a read-only filesystem, a restricted writable directory, dropped Linux capabilities, memory and CPU limits, and no host namespace sharing.
- Sanitize or validate HTML before rendering. Reject scripts, event-handler attributes, embedded frames, plugins, and resource URLs that are not required by the template.
- Disable JavaScript when the briefing template does not require it, and restrict network access so a local document cannot retrieve attacker-controlled remote resources.
- Keep Chrome patched and use a supported release to reduce exposure to known renderer vulnerabilities.
- Restrict accepted input paths to intended files and canonicalize them before use. Store generated screenshots in a private, per-run temporary directory to reduce interference between concurrent or untrusted runs.
- Remove