CVE-2026-33622

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab v0.8.3 through v0.8.5 allow arbitrary JavaScript execution through POST /wait and POST /tabs/id/wait when the request uses fn mode, even if security.allowEvaluate is disabled. POST /evaluate...

CVE-2026-33622

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab "v0.8.3" through "v0.8.5" allow arbitrary JavaScript execution through "POST /wait" and "POST /tabs/id/wait" when the request uses "fn" mode, even if "security.allowEvaluate" is disabled. "POS...