Playwright 1.64's bundled Chromium predates Chrome's 27 October security fixes

Playwright’s latest release, 1.64.1, downloads Chromium 156.0.8078.4 when you run npx playwright install. Google’s 27 October Chrome update moved stable to 156.0.8078.73/.74 with 52 security fixes. By version number, Playwright’s Chromium is older than that release, and Playwright launches it with Chromium’s sandbox switched off unless you ask for it.

The version numbers

The v1.64.0 release notes (7 October) list Chromium 156.0.8078.4, a Chrome for Testing build. The pinned browsers.json is unchanged in 1.64.1 (14 October): Chromium and Chromium Headless Shell revision 1248, version 156.0.8078.4. On 3 November, 1.64.1 was still the latest tag on npm and the latest GitHub release.

Google’s 27 October stable update lists 52 security fixes, four rated Critical. The first is CVE-2026-118306, “Memory corruption in FileSystem”. The CVE record says it affects Chrome “prior to 156.0.8078.73” and “allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page”. The list also includes a High-severity input validation bug in Headless (CVE-2026-118336). We have not tested which of these bugs exist in build .4. The point is that the CVE record’s affected range covers it, and Playwright has not shipped a newer build.

The sandbox is off by default

Playwright’s launch options document chromiumSandbox as “Enable Chromium sandboxing. Defaults to false.” The sandbox is the layer CVE-2026-118306 is described as escaping. With it off, code running in a compromised renderer is not held back by that layer at all. The Docker docs add that the official image runs browsers as root by default, which disables the Chromium sandbox. They say the image “is not recommended” for visiting untrusted websites, and for crawling recommend a separate user plus the seccomp profile they publish.

What upstream has done

A user opened issue #43664 on 27 October asking for a 1.64.x patch and Docker image with a newer Chromium 156 build. Playwright’s response, PR #43679, merged on 30 October and cherry-picked to the release-1.64 branch on 31 October (#43828). It changes how the Docker images are built so they pull the latest stable Chrome for Testing at build time. It does not change the npm package. On 3 November the release-1.64 branch still pins 156.0.8078.4 and no 1.64.2 tag exists. The main branch moved to Chromium 158.0.8127.2 on 30 October, which reaches users through the pre-release next builds, not a stable release. Chrome for Testing’s own stable channel was at 156.0.8078.80 on 3 November.

What to do now

• Turn the sandbox on. Pass chromiumSandbox: true to launch(). In containers, follow the Docker docs: a non-root user and the seccomp profile, or the sandbox cannot start.
• Use a patched Chrome. channel: 'chrome' makes Playwright drive the branded Google Chrome installed on the machine instead of its bundled Chromium. Check that the installed Chrome is at 156.0.8078.73 or later.
• Update when a release lands. Watch for a 1.64.x patch or 1.65 with a newer Chromium, and check browsers.json at the tag rather than assuming.

Why this matters

Agent builders increasingly point a Playwright-driven browser at pages nobody vetted, which is exactly the “crafted HTML page” case in the CVE record. Anthropic’s SDK browser toolsets, for example, leave the driver to you, and Anthropic has shown model-built Chrome exploit chains, so treat browser patch levels as part of your agent’s attack surface. Of the steps above, turning the sandbox on costs nothing and helps whatever Chromium build you run.