This vulnerability in zhayujie CowAgent up to version 2.1.0 involves the BrowserTool._do_navigate function in the agent/tools/browser/browser_tool.py file. Remote attackers can manipulate this function to cause information disclosure. The vulnerability requires no user interaction and low privileges, making it remotely exploitable. Although the issue was reported early to the project, no fix or official remediation has been released. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality.

Successful exploitation allows remote attackers to disclose information from the affected system via manipulation of the BrowserTool._do_navigate function. The impact is limited to information disclosure with low confidentiality impact. There is no indication of integrity or availability impact. The vulnerability does not require user interaction and can be triggered remotely with low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or released a fix, users should monitor for official updates from the vendor. Until a patch is available, consider restricting access to the affected component or network-level controls to limit exposure.