CVE-2026-33622

PinchTab CVE-2026-33622 affects PinchTab v0.8.3–v0.8.5, where POST /wait in fn mode could embed user-supplied expressions into executable JavaScript and run in the browser context, bypassing the security.allowEvaluate policy (though authentication is required). The issue constitutes a security-po...

CVE-2026-33622 A PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript Execution

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab v0.8.3 through v0.8.5 allow arbitrary JavaScript execution through POST /wait and POST /tabs/id/wait when the request uses fn mode, even if security.allowEvaluate is disabled. POST /evaluate...