Skip to content
OpenAdvisories

Package · npm

chrome-devtools-mcp

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 6.1
    CVE-2026-53765

    chrome-devtools-mcp: daemon.pid write follows symlinks in /tmp fallback runtime directory

    Chrome DevTools for agents (chrome-devtools-mcp) lets your coding agent control and inspect a live Chrome browser. From 0.20.0 until 1.1.0, The chrome-devtools-mcp daemon writes its PID file with fs.writeFileSync() to a deterministic runtime path. On typical …

    ChromeDevTools chrome-devtools-mcp chrome-devtools-mcp Browsers npm
  • Medium 6.1
    CVE-2026-53766

    chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots

    Chrome DevTools for agents (chrome-devtools-mcp) lets your coding agent control and inspect a live Chrome browser. From 0.24.0 until 1.1.0, McpContext.validatePath() enforces workspace roots by checking whether path.resolve(filePath) textually falls under one…

    ChromeDevTools chrome-devtools-mcp chrome-devtools-mcp Browsers npm