CVE-2026-53766

creationtimestamp| type| source ---|---|--- 2026-08-17 22:35:16+00:00| published-proof-of-concept| https://github.com/ChromeDevTools/chrome-devtools-mcp/security/advisories/GHSA-8qf9-62x2-82pp 2026-08-18 02:33:46+00:00| seen| https://gist.github.com/alon710/259d2014ae004d0972fa015a9b341f1e...

browser-ipc-cdp (>=2.0.0, <=3.13.0), chrome-devtools-mcp-docker (>=0.1.5, <=0.1.7) +1 more potentially affected by CVE-2026-53766 via chrome-devtools-mcp (0.25.0)

chrome-devtools-mcp NPM version 0.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on chrome-devtools-mcp and may be impacted: - browser-ipc-cdp =2.0.0, =0.1.5, =1.0.1, =1.0.9 Source cves: CVE-2026-53766 Source advisory:...

CVE-2026-53766 chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots

Chrome DevTools for agents chrome-devtools-mcp lets your coding agent control and inspect a live Chrome browser. From 0.24.0 until 1.1.0, McpContext.validatePath enforces workspace roots by checking whether path.resolvefilePath textually falls under one of the configured root paths. path.resolve...

CVE-2026-53766 chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots

Chrome DevTools for agents chrome-devtools-mcp lets your coding agent control and inspect a live Chrome browser. From 0.24.0 until 1.1.0, McpContext.validatePath enforces workspace roots by checking whether path.resolvefilePath textually falls under one of the configured root paths. path.resolve...