@arikdpc/chrome-devtools-mcp (>=0.12.1 <=0.12.4), @bachstudio/chrome-devtools-mcp (=0.10.3) +5 more potentially affected by CVE-2026-3941 via chrome-devtools-frontend (>=1.0.1532884 <=1.0.1555430)

chrome-devtools-frontend NPM version =1.0.1532884, =0.12.1, =1.0.2, =0.12.2, =0.3.17, =0.3.17, =0.3.22 Source cves: CVE-2026-3941 Source advisory: SNYK:JS-CHROMEDEVTOOLSFRONTEND-15467463...

EUVD-2026-11472

Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...

Linux Distros Unpatched Vulnerability : CVE-2026-3941

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted HT...

CVE-2026-3940

Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...

CVE-2026-3941

CVE-2026-3941 affects Google Chrome/Chromium DevTools: insufficient policy enforcement allows bypassing navigation restrictions via a crafted HTML page. Root cause: DevTools policy enforcement weakness. Impact: remote bypass of navigation controls; severity listed as Low (per Chromium description...

CVE-2026-3941

Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...

CVE-2026-3941

Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...

CVE-2026-3941

Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...

CVE-2026-3940

Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...

CVE-2026-3940

Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...

PT-2026-24888

CVE-2026-3941 Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.… https://t.co/9gTnqXNedp...

Google Chrome DevTools Heap Corruption Vulnerability

Google Chrome is a free web browser developed by Google Inc. A heap corruption vulnerability exists in Google Chrome DevTools, which stems from improper object destructuring and can be exploited by remote attackers to execute arbitrary code...

Linux Distros Unpatched Vulnerability : CVE-2026-3539

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Object lifecycle issue in DevTools in Google Chrome prior to 145.0.7632.159 allowed an attacker who convinced a user to install a malicious extension to...

CVE-2026-28458

Summary: OpenClaw’s Browser Relay /cdp WebSocket endpoint did not require an authentication token, allowing loopback connections to access sensitive data. Affected versions are OpenClaw 2026.1.20 up to 2026.2.0; the endpoint is at ws://127.0.0.1:18792/cdp. An attacker could steal session cookies ...

SUSE CVE-2026-3539

Determined a bug and not a vulnerability...

CVE-2026-3539

...

CVE-2026-3539

The CVE-2026-3539 entry corresponds to a heap-corruption vulnerability in Google Chrome DevTools, related to Chromium/DevTools issue prior to Chrome 145.0.7632.159. Credible sources (CNVD, CNNVD, EUVD, Astra Linux, Debian security advisories) describe an object-destructuring/DevTools issue that c...

CVE-2026-3539

...

OpenClaw Loopback CDP probe can leak Gateway token to local listener

Summary A local process can capture the OpenClaw Gateway auth token from Chrome CDP probe traffic on loopback. Details Affected versions inject x-openclaw-relay-token for loopback CDP URLs, and CDP reachability probes send that header to /json/version. If an attacker controls the probed loopback...

PT-2026-26006

Summary A local process can capture the OpenClaw Gateway auth token from Chrome CDP probe traffic on loopback. Details Affected versions inject x-openclaw-relay-token for loopback CDP URLs, and CDP reachability probes send that header to /json/version. If an attacker controls the probed loopback...