cross-origin iframes with depth limits #2766

pirate · 2025-08-23T02:42:27Z

Summary by cubic

Enable cross-origin iframe support by default with strict depth and count limits to prevent DOM explosions. Improves embedded content coverage while keeping performance stable and hardening dialog handling.

New Features
- Cross-origin iframes are on by default with safeguards: max depth 1 and up to 3 iframe documents per snapshot.
- Process cross-origin iframes only if visible and at least 200x200 px.
- DOM serializer caps recursion at 30 levels and does not traverse iframe contents.
- Added debug logs for frame counts, per-iframe IDs/URLs, and warnings when limiting frames.
Bug Fixes
- Wrapped DialogOpenedEvent dispatch in try/except to prevent crashes; errors are logged.

cubic-dev-ai

2 issues found across 4 files

_{React with 👍 or 👎 to teach cubic. You can also tag @cubic-dev-ai to give feedback, ask questions, or re-run the review.}

browser_use/browser/profile.py

browser_use/dom/serializer/serializer.py

…imits

…Profile class

- Updated logging statements to use multi-line formatting for better clarity. - Ensured consistent spacing and formatting throughout the service to enhance code maintainability.

…imits

github-actions · 2025-09-06T19:44:10Z

Agent Task Evaluation Results: 2/4 (50%)

View detailed results

Task	Result	Reason
amazon_laptop	✅ Pass	The agent successfully navigated to amazon.com, performed a search for 'laptop', and returned detailed information about the first laptop result including its title, price, rating, number of reviews, delivery date, stock status, and key specifications. This meets all the criteria for success.
google_maps_3d	❌ Fail	The agent successfully performed all steps except enabling the 3D view, which was explicitly required by the task. The 3D icon remained disabled throughout, and thus the agent did not fulfill the criterion of correctly clicking the 3D button to enable 3D mode. Therefore, the task is considered incomplete and unsuccessful.
browser_use_pip	✅ Pass	The agent's output includes the pip installation command 'pip install --upgrade browser-use', which contains the required command 'pip install browser-use'. Therefore, it meets the success criteria.
captcha_cloudflare	❌ Fail	The agent failed to locate and interact with the Cloudflare Turnstile captcha widget on the specified demo page, resulting in an inability to solve the captcha, click the check button, or extract the required 'hostname' value. Therefore, the task was not completed successfully as per the criteria.

Check the evaluate-tasks job for detailed task execution logs.

- Updated the method of accessing iframe dimensions from dictionary-style to attribute-style for improved clarity and consistency. - Ensured that width and height are directly accessed as properties of the bounds object.

…erialization depth handling

…rity and performance

cursor · 2025-09-08T03:44:12Z

browser_use/dom/service.py

+				self.logger.warning(
+					f'⚠️ Limiting processing of {original_doc_count} iframes on page to only first {MAX_TOTAL_IFRAMES} to prevent crashes!'
+				)
+				snapshot['documents'] = snapshot['documents'][:MAX_TOTAL_IFRAMES]


Bug: Iframe Limitation Affects Main Frame

The MAX_TOTAL_IFRAMES constant is intended to limit the number of iframe documents, but the current logic applies this limit to the total documents, including the main frame. This means fewer iframes are processed than expected, and the warning message about "iframes" is inaccurate.

Additional Locations (1)

browser_use/dom/service.py#L30-L32

shivamkhatri · 2025-09-08T23:35:16Z

browser_use/dom/serializer/serializer.py

 		"""Step 1: Create a simplified tree with enhanced element detection."""

+		# Prevent infinite recursion by limiting depth to 30 levels
+		if depth > 30:


Hi @MagMueller, Thanks for making the iframe count and depth configurable(#3026), but since it’s still hardcoded, it caused me some trouble while debugging.

Our webapp is fairly complex with a large hierarchy of elements, so 30 is a bit too low for our needs.

Could you also consider this and the other bugs under #nicehack69 (most bugs found category)?

what depth do you need @shivamkhatri?

cross-origin iframes on by default with depth limits

e725edb

cubic-dev-ai bot reviewed Aug 23, 2025

View reviewed changes

browser_use/browser/profile.py Outdated Show resolved Hide resolved

browser_use/dom/serializer/serializer.py Outdated Show resolved Hide resolved

MagMueller added 3 commits September 6, 2025 12:36

Merge commit 'af5b4400cd31644d06590ce5bcd0c19ac4ef35dd' into iframe-l…

66fc319

…imits

Update cross-origin iframe support description for clarity in Browser…

595a95f

…Profile class

Refactor logging statements in DomService for improved readability

ff27735

- Updated logging statements to use multi-line formatting for better clarity. - Ensured consistent spacing and formatting throughout the service to enhance code maintainability.

This comment was marked as outdated.

Sign in to view

Merge commit 'd58d2872c5ef9367e606dd155331bde3456de5ed' into iframe-l…

634a95b

…imits

Refactor iframe dimension retrieval in DomService

016a170

- Updated the method of accessing iframe dimensions from dictionary-style to attribute-style for improved clarity and consistency. - Ensured that width and height are directly accessed as properties of the bounds object.

This comment was marked as outdated.

Sign in to view

Update comment

9edfdfa

This comment was marked as outdated.

Sign in to view

MagMueller added 2 commits September 7, 2025 19:30

Merge branch 'main' into iframe-limits

f164d94

Update default cross-origin iframe setting to False and adjust tree s…

3dcd3c4

…erialization depth handling

This comment was marked as outdated.

Sign in to view

Update default cross-origin iframe setting to True for improved support

a0dd0c9

MagMueller mentioned this pull request Sep 8, 2025

Feature Request: ... Removal Of complex Iframe Flags desctributed among various files #2820

Closed

5 tasks

Update default cross-origin iframe setting to False for enhanced secu…

77eeed5

…rity and performance

MagMueller changed the title ~~cross-origin iframes on by default with depth limits~~ cross-origin iframes with depth limits Sep 8, 2025

Merge branch 'main' into iframe-limits

5060749

MagMueller enabled auto-merge September 8, 2025 03:41

MagMueller merged commit 93da79d into main Sep 8, 2025
54 checks passed

MagMueller deleted the iframe-limits branch September 8, 2025 03:43

cursor bot reviewed Sep 8, 2025

View reviewed changes

shivamkhatri reviewed Sep 8, 2025

View reviewed changes

shivamkhatri mentioned this pull request Sep 8, 2025

Configurable iframe depth still restricted by hardcoded limit #3034

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

cross-origin iframes with depth limits #2766

cross-origin iframes with depth limits #2766

Uh oh!

pirate commented Aug 23, 2025 •

edited by cubic-dev-ai bot

Loading

Uh oh!

cubic-dev-ai bot left a comment

Uh oh!

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

github-actions bot commented Sep 6, 2025 •

edited

Loading

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

cursor bot Sep 8, 2025

Uh oh!

shivamkhatri Sep 8, 2025

Uh oh!

pirate Sep 9, 2025

Uh oh!

shivamkhatri Sep 9, 2025

Uh oh!

Uh oh!

cross-origin iframes with depth limits #2766

cross-origin iframes with depth limits #2766

Uh oh!

Conversation

pirate commented Aug 23, 2025 • edited by cubic-dev-ai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by cubic

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

github-actions bot commented Sep 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Agent Task Evaluation Results: 2/4 (50%)

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

cursor bot Sep 8, 2025

Choose a reason for hiding this comment

Bug: Iframe Limitation Affects Main Frame

Uh oh!

shivamkhatri Sep 8, 2025

Choose a reason for hiding this comment

Uh oh!

pirate Sep 9, 2025

Choose a reason for hiding this comment

Uh oh!

shivamkhatri Sep 9, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

pirate commented Aug 23, 2025 •

edited by cubic-dev-ai bot

Loading

github-actions bot commented Sep 6, 2025 •

edited

Loading