This CVE (CVE-2026-73210) reveals a pattern worth recognizing: when a web capture tool like PlaywrightCapture adds security controls, developers tend to implement auxiliary operations — favicon retrieval, image proxying, resource prefetching — as separate code paths that bypass those controls. The only_global_lookup feature was designed to enforce network boundaries, but the favicon path used aiohttp.ClientSession directly, routing around the browser's request-routing layer where the global lookup logic lived. This wasn't malicious; it was simply the path of least resistance.
Two actions to take now. First, audit your codebase for other auxiliary network operations that might bypass only_global_lookup — the CVE description explicitly notes this is a complementary fix to CVE-2026-44439, which means the threat model was being reverse-engineered from incidents rather than proactively defined. Second, verify whether your URL validation routine is architecturally enforced (all network traffic must pass through it) or merely a helper function developers must remember to call. The former prevents bypasses; the latter is another check that can be forgotten.
The CVSS 5.1 score undersells this. A capture host's job is to fetch arbitrary content from anywhere — so an SSRF from that host can reach internal service discovery endpoints, metadata services, and admin interfaces that reject external traffic. The favicon request is trivial; the blast radius is everything your capture infrastructure can reach.
The deeper architectural problem: security features added reactively create scattered checks, and scattered checks produce scattered bypasses that follow the topology of the code rather than the intention of the threat model. Until adding a new network operation requires passing through validation by default — not as a step developers must remember — this pattern will keep generating CVEs.