
Security News
The Nightmare Before Deployment
Season’s greetings from Socket, and here’s to a calm end of year: clean dependencies, boring pipelines, no surprises.
patchright
Advanced tools
[!NOTE]
This repository serves the Patchright-Python Package. To use Patchright with NodeJS, check out the NodeJS Package. Also check out the main Patchright Driver Repository
If you’re looking for a high-performance browser automation platform checkout Hyperbrowser. It’s ideal for AI Agents, large-scale web scraping and automated testing.
Hyperbrowser delivers cloud-based browser infrastructure that scales instantly from a few sessions to thousands, with built-in CAPTCHA solving, stealth fingerprinting, and a global proxy network. It integrates seamlessly with Puppeteer, Playwright, and Selenium, so you can be up and running in minutes, no server or proxy management required.
Key Features:
👉 Learn more at hyperbrowser.ai
# Install Patchright with Pip from PyPI
pip install patchright
# Install Chromium-Driver for Patchright
patchright install chromium
[!IMPORTANT]
Patchright only patches CHROMIUM based browsers. Firefox and Webkit are not supported.
# patchright here!
from patchright.sync_api import sync_playwright
with sync_playwright() as p:
browser = p.chromium.launch()
page = browser.new_page()
page.goto('http://playwright.dev')
page.screenshot(path=f'example-{p.chromium.name}.png')
browser.close()
import asyncio
# patchright here!
from patchright.async_api import async_playwright
async def main():
async with async_playwright() as p:
browser = await p.chromium.launch()
page = await browser.new_page()
await page.goto('http://playwright.dev')
await page.screenshot(path=f'example-{p.chromium.name}.png')
await browser.close()
asyncio.run(main())
To be completely undetected, use the following configuration:
playwright.chromium.launch_persistent_context(
user_data_dir="...",
channel="chrome",
headless=False,
no_viewport=True,
# do NOT add custom browser headers or user_agent
...
)
[!NOTE]
We recommend using Google Chrome instead of Chromium. You can install it viapatchright install chrome(or via any other installation method) and use it withchannel="chrome".
This is the biggest Patch Patchright uses. To avoid detection by this leak, patchright avoids using Runtime.enable by executing Javascript in (isolated) ExecutionContexts.
Patchright patches this leak by disabling the Console API all together. This means, console functionality will not work in Patchright. If you really need the console, you might be better off using Javascript loggers, although they also can be easily detected.
Patchright tweaks the Playwright Default Args to avoid detection by Command Flag Leaks. This (most importantly) affects:
--disable-blink-features=AutomationControlled (added) to avoid navigator.webdriver detection.--enable-automation (removed) to avoid navigator.webdriver detection.--disable-popup-blocking (removed) to avoid popup crashing.--disable-component-update (removed) to avoid detection as a Stealth Driver.--disable-default-apps (removed) to enable default apps.--disable-extensions (removed) to enable extensionsPatchright patches some general leaks in the Playwright codebase. This mainly includes poor setups and obvious detection points.
Patchright is able to interact with elements in Closed Shadow Roots. Just use normal locators and Patchright will do the rest.
Patchright is now also able to use XPaths in Closed Shadow Roots.
With the right setup, Patchright currently is considered undetectable. Patchright passes:
See the original Playwright Documentation and API Reference
evaluate Method (Frame.evaluate, Page.evaluate, Locator.evaluate, Worker.evaluate, JSHandle.evaluate)isolated_context to choose Execution Context (Main/Isolated). Bool (optional, Defaults to True)object.evaluate(
expression: str,
arg: typing.Optional[typing.Any] = None,
...,
+ isolated_context: typing.Optional[bool] = True
)
evaluate_handle Method (Frame.evaluate_handle, Page.evaluate_handle, Locator.evaluate_handle, Worker.evaluate_handle, JSHandle.evaluate)isolated_context to choose Execution Context (Main/Isolated). Bool (optional, Defaults to True)object.evaluate_handle(
expression: str,
arg: typing.Optional[typing.Any] = None,
...,
+ isolated_context: typing.Optional[bool] = True
)
evaluate_all Method (Locator.evaluate_all)isolated_context to choose Execution Context (Main/Isolated). Bool (optional, Defaults to True)Locator.evaluate_all(
expression: str,
arg: typing.Optional[typing.Any] = None,
...,
+ isolated_context: typing.Optional[bool] = True
)
Deployment of new Patchright versions are automatic, but bugs due to Playwright codebase changes may occur. Fixes for these bugs might take a few days to be released.
If you choose to support our work, please contact @vinyzu or @steve_abcdef on Discord.
© Vinyzu
Patchright is licensed Apache 2.0
This repository is provided for educational purposes only.
No warranties are provided regarding accuracy, completeness, or suitability for any purpose. Use at your own risk—the authors and maintainers assume no liability for any damages, legal issues, or warranty breaches resulting from use, modification, or distribution of this code.
Any misuse or legal violations are the sole responsibility of the user.
FAQs
Undetected Python version of the Playwright testing and automation library.
We found that patchright demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Season’s greetings from Socket, and here’s to a calm end of year: clean dependencies, boring pipelines, no surprises.

Research
/Security News
Impostor NuGet package Tracer.Fody.NLog typosquats Tracer.Fody and its author, using homoglyph tricks, and exfiltrates Stratis wallet JSON/passwords to a Russian IP address.

Security News
Deno 2.6 introduces deno audit with a new --socket flag that plugs directly into Socket to bring supply chain security checks into the Deno CLI.