A vulnerability in browserless versions 1.44.0 through 2.56.7 allows authenticated token holders to bypass file protocol restrictions in Playwright websocket endpoints. This enables them to read arbitrary files accessible to the container process by navigating Playwright-driven browsers to file scheme URLs, despite the ALLOW_FILE_PROTOCOL setting defaulting to false. The issue is tracked as CVE-2026-92811 and has a CVSS score of 6.5, indicating a high severity risk.