Description
mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script execution, page content reading, and screenshot capture.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| hangwin | mcp-chrome-bridge | ≤ 1.0.31 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- mcp-chrome-bridge (hangwin/mcp-chrome) <= 1.0.31 - CORS Origin Bypass (CSWSH) http/cves/2026/CVE-2026-102878.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://github.com/hangwin/mcp-chrome/issues/384 issue-tracking
- https://github.com/hangwin/mcp-chrome/blob/v1.0.0/app/native-server/src/server/index.ts technical-description
- https://github.com/hangwin/mcp-chrome product
- VulnCheck Advisory: mcp-chrome-bridge through 1.0.31 CORS Origin Bypass third-party-advisory