# Playwright ships no browser; only its pinned test build lags Chrome security fixes

> Original title: 别急着删 Playwright：官方讲清楚它和浏览器安全到底是什么关系

- Source: meng shao
- Published: 2026-11-04T02:50:00.000Z
- Bad Influence: https://badinfluence.news/items/y70gdf81eif7gtuhflx5il3ox
- Original: https://x.com/shao__meng/status/2117811571674214571

## Summary

Playwright packages bundle no browser, but `npx playwright install` downloads a pinned Chrome for Testing build that can miss Chrome's latest security fixes and runs with the sandbox off by default. Playwright MCP and the CLI use your stable Chrome or Edge, which receive normal updates. For scripts visiting untrusted sites, Playwright recommends `chromium.launch({ channel: 'chrome', chromiumSandbox: true })`.

## Post

别急着删 Playwright：官方讲清楚它和浏览器安全到底是什么关系

有人说 Playwright 自带有漏洞的浏览器，所以应该删掉。这是误解，因为 Playwright 的任何安装包里都不带浏览器。真正需要注意的只有一种情况：测试用的固定版本浏览器不适合拿去访问不可信的网页。

用 Playwright MCP 或命令行工具的 Agent

这两种方式调用的是你电脑上的正式版 Chrome 或 Edge。浏览器会正常收到安全更新，沙箱也默认开着，所以不用改任何配置。

用测试运行器跑测试

运行 npx playwright install 时，Playwright 会下载 Chrome for Testing。这是测试专用的浏览器，版本固定为当前这一版 Playwright 测试过的那个版本。

这样做是故意的：每台开发电脑和每台 CI 机器跑的都是同一个浏览器，浏览器不会因为自动更新突然把测试搞挂。什么时候换浏览器版本，由你升级 Playwright 来决定。新版 Playwright 通常会固定一个比正式版 Chrome 更新的版本，所以兼容问题会在用户遇到之前先被你发现。

代价是，在下一版 Playwright 发布之前，这个浏览器可能缺少 Chrome 最新的安全修复，而且默认关闭沙箱。官方建议只用它对你自己可信的应用做端到端测试，不要用它访问来路不明的网站。

直接调用库 API

chromium.launch() 的默认设置和测试运行器一样：用固定版本的浏览器，沙箱关闭。如果你的代码会访问不受你控制的页面，比如爬虫或 Agent 脚本，就应该换成正式版 Chrome，并打开沙箱：

chromium.launch({ channel: 'chrome', chromiumSandbox: true })

另外，有些漏洞能突破沙箱，所以 Chrome 和 Edge 一定要保持更新。

![](https://badinfluence.news/api/img-proxy?u=https%3A%2F%2Fpbs.twimg.com%2Fmedia%2FHWP6X-jacAA9Ds-.jpg&mode=thumb&exp=1794009600&sig=18dc3c28ecb8b357)

## Quoted post @playwrightweb

> Playwright and browser security reminder.
> 
> We saw a post suggesting that you delete Playwright because it bundles browsers with CVEs. That is a misconception. Do not delete Playwright🙃. Here is how it works and what you should do.
> 
> No Playwright package bundles a browser. Agents on Playwright MCP or CLI run your stable Chrome, which gets Chrome's security updates, with the sandbox on.
> 
> 🤖 If you use Playwright MCP or the Playwright CLI
> 
> They use the stable Chrome / Edge on your machine, so it gets its normal updates. No config edit is needed.
> 
> 🧪 If you use the test runner
> 
> When you run npx playwright install, Playwright downloads Chrome for Testing, pinned to the build we tested that release against. The pin is on purpose. Your tests run on the same browser on every laptop and CI machine, and a browser 
> update cannot suddenly break your suite. You choose when to move by upgrading Playwright. New releases usually pin a build ahead of stable Chrome, so you see breakage before your users do.
> 
> We recommend this for full e2e test suites on your own trusted app. This build can miss Chrome security fixes until the next Playwright release, and by default it runs with the sandbox off. Do not use it on the hostile web.
> 
> 📚 If you use the library API
> 
> chromium.launch() has the same defaults: the pinned build with the sandbox off. If your code visits pages you don't control (scrapers, agent scripts), max out protection:
> 
> chromium.launch({ channel: 'chrome', chromiumSandbox: true })
> 
> 🔒 Always keep Chrome / Edge updated. Some bugs can escape a sandbox.
> 
> Happy testing!

https://x.com/playwrightweb/status/2117638981454291252