A small browser runner still needs separate isolation
Webframe runs a page inside the operating system’s browser engine and connects JavaScript output to the terminal, avoiding a bundled browser. An AI-generated evaluation commissioned by Simon Willison found the tested snapshot useful for scraping but unsuitable as a security boundary on its own: pages retained network access and persistent storage, and lacked execution limits. Those findings describe one tested revision.
Simon Willison · Oct 26, 2026
Why it matters
Tool builders should distinguish convenient browser execution from isolation strong enough for untrusted code.
More context
The report tested revision 03155e2 and proposed extra process, network and profile isolation. The project documents a Go 1.27+ source build; Linux needs WebKitGTK and a display or Xvfb. Treat it as an experiment and review the current implementation before adopting it.
Keep in mind
The evaluation is explicitly LLM-generated, not an independent security audit. Current repository behavior may differ from the tested snapshot, and the report itself lists further hardening work.
Original read