The vulnerability CVE-2026-15329 affects zhayujie CowAgent versions 2.0 and 2.1.0 in the BrowserTool._do_navigate function of the Browser Tool component (agent/tools/browser/browser_tool.py). An attacker can remotely manipulate this function to cause information disclosure. The vulnerability does not require user interaction and can be exploited with low privileges. Although the issue was reported early to the project, there has been no response or official remediation. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality.

Successful exploitation of this vulnerability allows remote attackers to disclose information from the affected CowAgent software. The impact is limited to information disclosure with low confidentiality impact. There is no indication of integrity or availability impact. The vulnerability requires low privileges and no user interaction, making it moderately accessible to attackers. No known exploits in the wild have been reported.

No official patch or remediation is currently available for this vulnerability. The vendor has not responded to the issue report. Users should monitor the vendor's communications for any future updates or fixes. Until a fix is provided, consider restricting network access to the affected component to trusted sources only to reduce exposure.