chrome-devtools-mcp CVE-2026-106484

Requires all of: chrome-devtools-mcp version 1.1.0 through 1.4.0 running on Linux with MCP roots configured to restrict file access to a workspace; a local attacker able to write into that workspace root to pre-plant a symlink whose name carries the tool's enforced output extension (e.g. report.png) and that targets a victim-writable file outside the root; and the MCP agent being driven to call an extension-enforcing output sink - demonstrated with take_screenshot (src/tools/screenshot.ts:216), and reachable via the same McpContext.saveFile pattern used by script, lighthouse, performance, and NetworkFormatter/McpResponse exports - with a caller path (e.g. report.txt) that passes roots validation before the extension rewrite. Limiting factors: no network vector (local only), the attacker needs prior local write access to stage the symlink, the tool must be invoked (user/agent interaction), and the written bytes are largely tool-generated (screenshot/report content) rather than fully attacker-chosen, bounding integrity impact.

Signals are consistent and point to a genuine but moderate, locally-gated issue rather than a mass-exploitation emergency. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N = 4.4, Medium) matches the description's 'local attacker' framing: exploitation is local, not network-facing, and requires user/agent interaction (invoking an output-producing tool). No EPSS score and no CISA KEV entry are present in the input, so there is no evidence of active or widespread exploitation; the vuln.today decision label is 'this_month' (not act_now/emergency), reinforcing a planned-remediation rather than drop-everything posture. Counterbalancing this, the GHSA advisory contains detailed, runnable proof-of-concept scripts (a self-contained lab PoC plus a full MCP stdio PoC against real Chrome), so a working exploit path is publicly documented, and this is explicitly an incomplete-fix variant of the same boundary class as CVE-2026-53766 - meaning the root-cause area has recurred. Net: a real, patch-worthy MCP roots sandbox-escape, but its impact is bounded by the need for local filesystem access to pre-plant a symlink and for the tool to be triggered, keeping it below network-RCE urgency.

On a developer workstation running chrome-devtools-mcp (1.1.0-1.4.0) on Linux with MCP roots configured, a local attacker (or a prior foothold) pre-plants a symlink named with an enforced output extension, e.g. workspace/report.png, pointing at a victim-writable file outside the workspace root. When the MCP agent is driven to run an output tool such as take_screenshot with filePath 'workspace/report.txt' (format png), roots validation passes on the .txt path but ensureExtension rewrites the sink to report.png after validation, so the write follows the symlink and lands outside the configured root. The GHSA advisory publishes working PoC code demonstrating exactly this overwrite end-to-end.