CVE-2025-47241: Browser Use allows bypassing `allowed_domains` by putting a decoy domain in http auth username portion of a URL

During a manual source code review, ARIMLABS.AI researchers identified that the browser_use module includes an embedded allow list functionality to restrict URLs that can be visited. This restriction is enforced during agent initialization. However, it was discovered that these measures can be bypassed, leading to severe security implications.