CVE-2026-73210: Lookyloo PlaywrightCapture SSRF Vulnerability

CVE-2026-73210 Overview

CVE-2026-73210 is a Server-Side Request Forgery (SSRF) vulnerability in Lookyloo's PlaywrightCapture library. The flaw affects the favicon retrieval routine when the only_global_lookup option is enabled. This option is designed to prevent captures from accessing local, loopback, or non-public network resources. However, favicon fetching bypassed the browser request-routing protections and issued HTTP requests directly through an aiohttp.ClientSession. An attacker who controls a rendered web page can supply a crafted favicon reference pointing to internal infrastructure. The vulnerability is classified under CWE-918 and complements the earlier fix tracked as CVE-2026-44439.

Critical Impact
A malicious page can force the PlaywrightCapture host to issue HTTP requests to internal services, enabling internal discovery, resource access, and interaction with capture-only HTTP endpoints.

Affected Products

Lookyloo PlaywrightCapture (versions prior to the patch commit 5e6679717e97f7a18bb71d00a16b0876997fa10d)
Deployments where PlaywrightCapture runs with only_global_lookup enabled
Downstream Lookyloo capture infrastructure relying on PlaywrightCapture for rendering

Discovery Timeline

2026-08-11 - CVE-2026-73210 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73210

Vulnerability Analysis

PlaywrightCapture executes browser-driven captures with network restrictions configured via the only_global_lookup option. This setting instructs the browser layer to reject requests targeting loopback addresses, private IP ranges, and other non-global destinations. The favicon retrieval workflow operated outside this enforcement path. After the page rendered, favicon URLs extracted from the HTML were resolved and fetched directly using aiohttp.ClientSession, bypassing the browser routing controls. The disconnect between the two request paths allowed a controlled page to reach internal HTTP services from the capture host.

Root Cause

The root cause is inconsistent enforcement of network access restrictions across code paths. The browser-driven capture honored only_global_lookup, but favicon fetching used an independent HTTP client that lacked URL validation. Favicon references from attacker-influenced HTML were trusted without checking whether the resolved destination was globally routable.

Attack Vector

An attacker submits or hosts a web page processed by PlaywrightCapture. The page includes a <link rel="icon"> or similar favicon reference pointing to a loopback address, an RFC1918 private IP, a .local hostname, or another internal resource. During capture, PlaywrightCapture extracts the favicon URL and issues an aiohttp GET request to that destination. The response, or the observable side effects, can reveal the presence and behavior of internal services reachable only from the capture host. Depending on the target, the request may interact with unauthenticated HTTP endpoints on the internal network.

No verified proof-of-concept code is published. See the GitHub Commit for PlaywrightCapture for the corrective change.

Detection Methods for CVE-2026-73210

Indicators of Compromise

Outbound HTTP requests from the PlaywrightCapture host targeting RFC1918 ranges, 127.0.0.0/8, 169.254.0.0/16, or .local hostnames during or immediately after capture jobs.
aiohttp.ClientSession requests in application logs whose destination hostnames resolve to non-global addresses.
Captures of pages containing favicon <link> tags whose href attributes reference internal IP addresses or cloud metadata endpoints such as 169.254.169.254.

Detection Strategies

Correlate PlaywrightCapture process network activity against a deny-list of internal CIDR ranges to identify SSRF probes.
Inspect submitted URL corpora and captured HTML for favicon references pointing to non-public destinations.
Baseline normal favicon retrieval traffic and alert on deviations targeting loopback, link-local, or metadata IP addresses.

Monitoring Recommendations

Log all outbound HTTP requests generated by capture infrastructure with source process, destination host, and resolved IP.
Forward capture host telemetry to a centralized data lake to enable retrospective hunts for internal reconnaissance patterns.
Alert on any capture-initiated request to cloud metadata services or internal management interfaces.

How to Mitigate CVE-2026-73210

Immediate Actions Required

Upgrade PlaywrightCapture to a version including commit 5e6679717e97f7a18bb71d00a16b0876997fa10d or later.
Audit capture infrastructure logs for prior favicon fetches targeting internal IP addresses.
Segment the PlaywrightCapture host from sensitive internal services and management interfaces.

Patch Information

The patch introduces a common URL validation routine and applies it to favicon retrieval. Direct non-global IP addresses, localhost, .local domains, malformed URLs, and other explicitly non-public destinations are rejected before the favicon request is issued. Review the GitHub Commit for PlaywrightCapture for implementation details. This fix complements the earlier remediation tracked as CVE-2026-44439.

Workarounds

Deploy PlaywrightCapture behind an egress proxy that blocks connections to RFC1918, loopback, link-local, and cloud metadata address ranges.
Run the capture host in a network namespace with no route to internal services other than required upstream infrastructure.
Disable favicon retrieval in capture configuration if the feature is not required for the deployment.

bash

# Example egress restriction using iptables on the capture host
iptables -A OUTPUT -d 127.0.0.0/8   -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8    -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -d 169.254.0.0/16 -j REJECT