Researcher Finds Remote Code Execution Flaw in PostHog's Production Systems

A security researcher at Hacktron discovered that PostHog, a popular product analytics platform, was running its Chromium browser without standard security sandboxing when generating heatmap screenshots. This configuration, flagged during a routine code scan, created an opportunity for a deeper attack rather than a simple misconfiguration report.

The researcher used AI tools to help build a working exploit targeting a known Chrome vulnerability (CVE-2026-7899), eventually achieving remote code execution inside a PostHog worker container that had access to the production database. The process took roughly 36 hours and involved significant trial and error, including testing a different exploit that only worked on ARM64 systems before switching to one compatible with PostHog's x86_64 infrastructure. Notably, newer AI models assisted more efficiently and with fewer shortcuts than earlier versions used earlier in the process.

This case highlights a growing trend: AI tools are making it faster and cheaper for both researchers and attackers to develop working exploits from known vulnerabilities, shrinking the time window businesses have to patch issues before they are weaponised. Running browser automation tools with reduced security protections, even for seemingly low-risk tasks like screenshot generation, can expose far more of a company's infrastructure than expected.

Key Takeaway: Australian small businesses using third-party analytics or automation tools should ensure vendors run browser-based components with proper security sandboxing enabled, and should ask vendors directly about how they isolate automated processes from production systems.