mcp-chrome-bridge EUVD-2026-89413

Exploitation requires that the victim is actively running the mcp-chrome-bridge native-server (≤1.0.31) exposing its local HTTP automation API, AND that the victim visits or is redirected to an attacker-controlled web page in a browser on the same host (UI:P). The core enabling condition is the missing/incorrect Origin (CORS) validation on the native-server HTTP API, which lets cross-origin browser requests reach and invoke automation endpoints. Limiting factors: the bridge must be installed and running, the attack depends on victim browsing action, and the population is limited to users of this specific MCP developer tool; no authentication is needed once those conditions are met.

Multiple signals converge on a genuinely serious but interaction-gated issue. The vendor CVSS 4.0 base of 8.6 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N) reflects an unauthenticated, low-complexity network-reachable flaw whose only friction is that a victim must visit an attacker-controlled web page (UI:P). CWE-346 (origin validation error) is consistent with the description: the native-server HTTP API fails to enforce Origin/CORS restrictions, so any web page loaded in the victim's browser can reach the loopback automation server. No EPSS score, no CISA KEV listing, and no public exploit are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - this is not confirmed active exploitation. The high VC:H/VI:H is credible because the exposed tools include arbitrary script execution, page content reading, and screenshot capture, effectively giving a remote page full browser-automation control. The main tension is that raw impact is high while real-world reach is constrained by the niche footprint of this npm bridge and the requirement that the victim both run the bridge and browse to a malicious site; treat this as a real priority for the specific population that installs mcp-chrome-bridge, but not a mass-exploitation event. Note the input Tags list 'Google' as vendor, which is incorrect - the project is the independent open-source hangwin/mcp-chrome, not a Google product.

A developer or power user runs mcp-chrome-bridge (≤1.0.31) so an MCP client can drive their Chrome browser via the loopback native-server HTTP API. The attacker lures that user to a malicious web page, which issues cross-origin requests to the local server; because origin validation is broken, the requests are accepted and the page invokes automation tools to execute scripts, exfiltrate page content, and capture screenshots. No public exploit code is identified in the provided data, but the attack requires only a crafted page and a single victim visit.