Live › vulnerability › CVE-2026-106484
Go to dashboardThe chrome-devtools-mcp server bundled with Google Chrome on Linux fails to enforce its policy when handling a malicious file. A local attacker can use it to perform arbitrary reads and writes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 19:34 UTC. All times on this page are UTC.
Teams running chrome-devtools-mcp on Linux machines where a local user or process can supply files to it, prior to version 1.5.0. Systems without this MCP server installed, or on other operating systems, are not indicated as affected by the sources.
No product ranges from the sources yet.
npx chrome-devtools-mcp --version or by reviewing the package.json of the project that depends on it1.5.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux prior to 1.5.0 allowed a local attacker to perform arbitrary read/write via a malicious file. (Chromium security severity: Medium)
This page as .md · .json · in your agent: get_signal("CVE-2026-106484")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.