Disclosed weakness · no CVE recorded

EMBRACE: Cursor browser bridge injects agent instructions

Anysphere / Cursor · Cursor integrated browser

First documented disclosure · Review checkpoint

Summary

A visited page can forge content in the agent composer.

Severity and exploitation evidence

Unknown · numeric CVSS score not recorded. Severity source.

Exploitation not established: Controlled researcher demonstration; malicious exploitation is not established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The page-accessible selection bridge accepts attacker-supplied attributes as agent input.

Conditions required

An affected build visits hostile content; the user presses Enter to approve the focused action, and model behavior completes the chain.

Potential impact

Host code execution demonstrated after an agent retry outside its sandbox.

Affected versions and configurations

Researcher-tested build; numeric range not published.

Fix and mitigation status

Researcher reports an October 1 fix; no build number verified.

Practical next steps

Use a current supported build, isolate untrusted pages and review actual command approvals.

Operating lesson

Page content must not acquire the authority of user instructions.

Evidence and limits

Reported privately September 10; public October 29. Success was model-dependent and required a user keystroke. No CVE or numeric severity was published.

Related incident and research records

Related records can include laboratory demonstrations; a relationship does not itself establish exploitation.

Sources