ChromeDevTools vulnerabilities (CVE)

CVE records published for ChromeDevTools, newest first. Follow to get an email when a new one appears.

2 results

6.1Medium

CVE-2026-53765 4 months ago

chrome-devtools-mcp: daemon.pid write follows symlinks in /tmp fallback runtime directory

ChromeDevTools chrome-devtools-mcp

Chrome DevTools for agents (chrome-devtools-mcp) lets your coding agent control and inspect a live Chrome browser. From 0.20.0 until 1.1.0, The chrome-devtools-mcp daemon writes its PID file with fs.writeFileSync() to a deterministic runtime path. On typical …

6.1Medium

CVE-2026-53766 4 months ago

chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots

ChromeDevTools chrome-devtools-mcp

Chrome DevTools for agents (chrome-devtools-mcp) lets your coding agent control and inspect a live Chrome browser. From 0.24.0 until 1.1.0, McpContext.validatePath() enforces workspace roots by checking whether path.resolve(filePath) textually falls under one…