bb-browser

Adapter Injection via local-llm-review

references/site-system.md

Adapters can be stored in `~/.bb-browser/sites/` and override community adapters. This could be exploited to inject malicious adapters that perform unauthorized actions.

Code Execution via local-llm-review

references/adapter-development.md

Adapters are JS files that run in the user's browser. If an adapter is malicious, it could execute arbitrary code in the user's browser context.

Data Exfiltration via local-llm-review

references/fetch-and-network.md

The `fetch` command allows users to make requests with browser session context, including cookies and login state. This could be used to exfiltrate sensitive data from private or logged-in pages if mi

Tab Management and Session Hijacking via local-llm-review

references/site-system.md

The tool automatically manages tabs and matches them based on domain. This could be exploited to hijack sessions or perform actions in the wrong tab if not properly secured.