A security flaw in Browserbase's Autobrowse Trace Artifact Handler causes the system to create trace artifact files with incorrect default permissions. This misconfiguration can allow an attacker with local access to read or alter the files, potentially exposing sensitive data or modifying trace information. The weakness reflects improper privilege handling (CWE‑266) and incorrect permission assignment (CWE‑276).

The vulnerability affects all instances of Browserbase software released up to and including version 20260526. The affected component is the Autobrowse Trace Artifact Handler within Browserbase. No other vendors or products are listed.

The CVSS score of 4.8 indicates a moderate severity, and the EPSS score is not available. While the attack requires a local approach, the publicly released exploit suggests that an attacker who can execute code locally on the machine running Browserbase may use the vulnerability to read or modify trace artifacts. Since it is not documented in the CISA KEV catalog, no known large-scale exploits are reported yet, but the local nature of the attack limits the threat to environments where an attacker can gain local execution.