v2.0.10-beta v1.18.1

Name: camofox-browser
Author: jo-inc

low risk

jo-inc/camofox-browserOct 4, 2026 → Oct 5, 20260 days between releases

What's New

Fixes broken MCP paths, VNC exposure, and pins browser binary

Breaking Changes

VNC behavior changed: Native VNC defaults to loopback; non-loopback requires VNC_PASSWORD.

Improvements

Browser binary pinned to Camoufox 152.0.4-beta.30 for compatibility.
MCP server functionality restored with corrected package structure.
VNC exposure vulnerability addressed by restricting port bindings.
Root and standalone MCP dependencies pinned to patched hono version.

Bug Fixes

MCP server starts again with corrected package path.
Container VNC no longer exposes ports unexpectedly.
Browser binary startup incompatibility resolved.

Upgrade Notes

If using native VNC, ensure VNC_RFB_BIND and VNC_PASSWORD are set. The browser binary is now pinned to Camoufox 152.0.4-beta.30.

The Two Releases

v2.0.10-beta

Oct 4, 2026· 17 days ago

Fixes critical security vulnerabilities in API token renewal and TOTP re-enrollment, adds password change requirements, and expands config variable support.

Full release notes

v1.18.1

v1.18.1 — VNC compatibility and MCP startup fix

Oct 5, 2026· 17 days ago

Fixes broken paths for the bundled MCP server and resolves container VNC exposure issues by pinning the browser binary.

Full release notes