CVE-2026-84833
Received Received - Intake

Resource Consumption in OpenBrowser Browser Agent

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: VulDB

Description
A vulnerability was found in ntegrals openbrowser up to 067fc45d649baa961750da8e2f4a75d87c5c75c8. Affected by this vulnerability is an unknown functionality of the file packages/core/src/agent/agent.ts of the component Browser Agent Message Construction. Performing a manipulation results in resource consumption. It is possible to initiate the attack remotely. The exploit has been made public and could be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84833
EUVD
EUVD-2026-70227

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ntegrals openbrowser to 067fc45d649baa961750da8e2f4a75d87c5c75c8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-404 The product does not release or incorrectly releases a resource before it is made available for re-use.
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-84833 is a Denial of Service (DoS) vulnerability in the OpenBrowser browser agent. It allows an attacker to exhaust LLM service resources by sending a single malicious web page. The issue occurs because OpenBrowser serializes untrusted page content into LLM messages without size limits. A large control like a button with ~1.1 million characters can create a 2.2MB model request, causing the LLM service to become temporarily unavailable.

Detection Guidance

Monitor for unusually large LLM service requests or timeouts during page summarization tasks. Check for pages with excessive text in interactive elements like buttons or links. Use network inspection tools to observe request sizes exceeding typical thresholds.

Impact Analysis

This vulnerability can cause service unavailability, timeouts for unrelated requests, increased response times (from 294ms to over 5 seconds), memory and CPU pressure, and potential financial costs if using paid LLM services. It may disrupt normal operations when users perform tasks like summarizing pages.

Compliance Impact

This vulnerability primarily causes resource exhaustion leading to Denial of Service (DoS) conditions, which may indirectly impact compliance with standards like GDPR or HIPAA by disrupting service availability or increasing response times. However, the provided context does not explicitly link this vulnerability to specific compliance violations or regulatory requirements.

Mitigation Strategies

Implement hard size limits for message construction in OpenBrowser. Truncate oversized content before sending to LLM services. Add configurable input caps to prevent resource exhaustion. Monitor LLM service performance for unusual delays or failures.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84833. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart