Bug
browser.navigate correctly routes non-http(s) schemes (file://, javascript:, data:, chrome://, …) through the approval gate via isSafeUrl + requireApproval.
browser.tabs with action: "new" and a url argument does not share that gate. The tool builder forwards the raw URL straight into PlaywrightBackend.tabs → page.goto(url), so a model can open local files or script URLs in a new tab without prompting the operator.
Expected
Opening a new tab with a non-http(s) URL should require the same approval as browser.navigate.
Actual
No approval is requested; the URL loads immediately (subject only to Playwright/page.goto succeeding).
Impact
Same danger surface as navigate, but presently unguarded — local file exfiltration / scripted tab opens via a secondary tool path.
Notes
- Verified against current
main (src/tools/browser/tabs.ts, navigate.ts, playwright-backend.ts).
- Prefer fixing the tool layer (mirror navigate) over changing backend
goto semantics broadly.
Bug
browser.navigatecorrectly routes non-http(s)schemes (file://,javascript:,data:,chrome://, …) through the approval gate viaisSafeUrl+requireApproval.browser.tabswithaction: "new"and aurlargument does not share that gate. The tool builder forwards the raw URL straight intoPlaywrightBackend.tabs→page.goto(url), so a model can open local files or script URLs in a new tab without prompting the operator.Expected
Opening a new tab with a non-http(s) URL should require the same approval as
browser.navigate.Actual
No approval is requested; the URL loads immediately (subject only to Playwright/
page.gotosucceeding).Impact
Same danger surface as navigate, but presently unguarded — local file exfiltration / scripted tab opens via a secondary tool path.
Notes
main(src/tools/browser/tabs.ts,navigate.ts,playwright-backend.ts).gotosemantics broadly.