Anurag Yadav

Playwright and browser security reminder. We saw a post suggesting that you delete Playwright because it bundles browsers with CVEs. That is a misconception. Do not delete Playwright🙃. Here is how it works and what you should do. No Playwright package bundles a browser. Agents on Playwright MCP or CLI run your stable Chrome, which gets Chrome's security updates, with the sandbox on. 🤖 If you use Playwright MCP or the Playwright CLI They use the stable Chrome / Edge on your machine, so it gets its normal updates. No config edit is needed. 🧪 If you use the test runner When you run npx playwright install, Playwright downloads Chrome for Testing, pinned to the build we tested that release against. The pin is on purpose. Your tests run on the same browser on every laptop and CI machine, and a browser update cannot suddenly break your suite. You choose when to move by upgrading Playwright. New releases usually pin a build ahead of stable Chrome, so you see breakage before your users do. We recommend this for full e2e test suites on your own trusted app. This build can miss Chrome security fixes until the next Playwright release, and by default it runs with the sandbox off. Do not use it on the hostile web. 📚 If you use the library API chromium.launch() has the same defaults: the pinned build with the sandbox off. If your code visits pages you don't control (scrapers, agent scripts), max out protection: chromium.launch({ channel: 'chrome', chromiumSandbox: true }) 🔒 Always keep Chrome / Edge updated. Some bugs can escape a sandbox. Happy testing!