CVE-2026-53765: Chrome DevTools MCP Privilege Escalation

CVE-2026-53765 Overview

CVE-2026-53765 affects chrome-devtools-mcp, the Model Context Protocol daemon that lets coding agents control and inspect a live Chrome browser. The daemon writes its PID file with fs.writeFileSync() to a deterministic path without the O_NOFOLLOW flag. On macOS and on Linux sessions where $XDG_RUNTIME_DIR is unset, that path resolves to /tmp/chrome-devtools-mcp-<uid>/daemon.pid. A local low-privilege user on the same POSIX host can pre-create that path as a symlink targeting any file writable by the victim. When the victim starts daemon mode, the write follows the symlink and truncates the target file to the daemon PID string. The issue is fixed in version 1.1.0 and is tracked as [CWE-59] Link Following.

Critical Impact
A local attacker can use a symlink attack to truncate arbitrary files writable by the victim user, corrupting data and enabling integrity compromise on shared POSIX hosts.

Affected Products

chrome-devtools-mcp versions 0.20.0 through versions prior to 1.1.0
Deployments on macOS where the runtime path falls back to /tmp
Linux sessions where $XDG_RUNTIME_DIR is unset

Discovery Timeline

2026-06-24 - CVE-2026-53765 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53765

Vulnerability Analysis

The chrome-devtools-mcp daemon records its process ID by calling fs.writeFileSync() against a predictable runtime path. On macOS, and on Linux when $XDG_RUNTIME_DIR is not exported, the path falls back to /tmp/chrome-devtools-mcp-<uid>/daemon.pid. The /tmp directory is world-writable, and the daemon does not validate that the target is a regular file before opening it.

Because the open operation omits the O_NOFOLLOW flag, the kernel follows any symbolic link present at the destination. An attacker who knows the victim's UID can pre-create the directory and place a symlink at daemon.pid pointing to any file the victim can write. When the victim launches daemon mode, the write truncates the linked file and replaces its contents with the daemon's PID string.

Root Cause

The root cause is a classic link-following weakness [CWE-59]. The PID file write trusts a path under a shared, attacker-influenced directory and does not enforce O_NOFOLLOW or verify the target's inode before writing. Predictable filenames based on UID make pre-positioning trivial.

Attack Vector

Exploitation requires local access and low privileges on the same POSIX host. The attacker creates /tmp/chrome-devtools-mcp-<victim_uid>/ and places a symlink named daemon.pid that points to a file owned and writable by the victim, for example a shell startup file or an application configuration file. When the victim later invokes daemon mode, the daemon truncates the target file and writes the daemon PID. This destroys file contents and can be staged to corrupt configuration or scripts the victim subsequently executes.

No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-3pvj-jv98-qhjq for upstream technical details.

Detection Methods for CVE-2026-53765

Indicators of Compromise

Presence of /tmp/chrome-devtools-mcp-<uid>/daemon.pid as a symbolic link rather than a regular file
Unexpected truncation of user-owned files containing only a numeric PID string
Pre-existing /tmp/chrome-devtools-mcp-<uid>/ directories owned by a UID other than the matching user

Detection Strategies

Audit /tmp for chrome-devtools-mcp-* directories and verify ownership matches the embedded UID.
Inspect daemon.pid files with ls -l and stat to confirm they are regular files, not symlinks.
Hunt for file integrity changes on user-writable configuration files that now contain only digits.

Monitoring Recommendations

Enable file integrity monitoring on user home directories and shell startup files on multi-user POSIX hosts.
Log and alert on symlink creation within /tmp that targets paths outside of /tmp.
Track installed versions of chrome-devtools-mcp across developer workstations to identify hosts still on vulnerable releases.

How to Mitigate CVE-2026-53765

Immediate Actions Required

Upgrade chrome-devtools-mcp to version 1.1.0 or later on all developer endpoints.
Inventory macOS and Linux systems where multiple local users share the host and prioritize them for patching.
Inspect /tmp/chrome-devtools-mcp-* paths before next daemon start and remove any pre-existing symlinks.

Patch Information

The maintainers fixed the issue in chrome-devtools-mcp version 1.1.0. See the GitHub Security Advisory GHSA-3pvj-jv98-qhjq for the upstream advisory and fix commit references.

Workarounds

Export $XDG_RUNTIME_DIR to a user-private directory such as /run/user/<uid> before starting the daemon on Linux.
Pre-create /tmp/chrome-devtools-mcp-<uid>/ as a regular directory owned by the user with mode 0700 before launching the daemon.
Restrict shared host access so that untrusted local users cannot reach /tmp on developer workstations.

bash

# Configuration example: set a private runtime directory before launching the daemon
export XDG_RUNTIME_DIR="/run/user/$(id -u)"
mkdir -p "$XDG_RUNTIME_DIR" && chmod 700 "$XDG_RUNTIME_DIR"
npm install -g chrome-devtools-mcp@1.1.0