CVE-2026-53766: Chrome DevTools MCP Path Traversal Flaw

CVE-2026-53766 Overview

CVE-2026-53766 is a path traversal vulnerability [CWE-22] in the Chrome DevTools for agents package (chrome-devtools-mcp). The flaw affects versions 0.24.0 through 1.0.x and is fixed in 1.1.0. The McpContext.validatePath() function relies on path.resolve() to enforce workspace root boundaries. Because path.resolve() does not canonicalize symbolic links, a symlink placed inside an authorized workspace root can reference a file outside that root and still pass validation. Downstream file read and write tools then follow the symlink, breaking the workspace isolation contract.

Critical Impact
Coding agents using chrome-devtools-mcp can overwrite arbitrary files outside the declared workspace roots and exfiltrate sensitive files to the controlled browser session.

Affected Products

chrome-devtools-mcp versions 0.24.0 through 1.0.x
Coding agents and MCP clients integrating the affected package
Chrome DevTools-controlled browser sessions exposed via the MCP server

Discovery Timeline

2026-06-24 - CVE-2026-53766 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53766

Vulnerability Analysis

The Chrome DevTools MCP server exposes file-aware tools to coding agents. To prevent agents from touching arbitrary host paths, the server lets MCP clients declare workspace roots through the roots capability. The McpContext.validatePath() routine is supposed to enforce that every accessed file lives under one of those roots.

Validation runs path.resolve(filePath) and checks whether the resulting string is textually prefixed by an allowed root. path.resolve() only normalizes .. segments and joins relative paths against the working directory. It does not call realpath() and does not resolve symbolic links along the path. An attacker who can plant or influence a symlink inside a workspace root therefore passes the string comparison while the underlying inode lives elsewhere on the filesystem.

This is distinct from the documented legacy behavior in which a missing roots capability disables path restrictions. The bypass occurs even when the client correctly declares a non-empty roots list.

Root Cause

The root cause is the use of lexical path resolution instead of canonical path resolution for a security boundary. path.resolve() operates on strings, while symlink-aware checks require resolving the path against the real filesystem using fs.realpath() or equivalent. Treating string containment as filesystem containment produces a classic [CWE-22] path traversal through link following.

Attack Vector

An attacker with the ability to create files inside the workspace, including a prompt-injected agent or a malicious dependency, creates a symlink such as ./notes.txt pointing to /etc/hosts or ~/.ssh/authorized_keys. The agent then invokes a write-capable tool with filePath=./notes.txt. Validation passes because the resolved string still sits under the workspace root, and the write follows the symlink to the external target.

In the read direction, upload_file reads through the same symlink and pushes the contents to the currently selected web page, enabling exfiltration to any site the agent is currently visiting. Exploitation requires local access and low privileges, with no user interaction.

No verified public proof-of-concept code is published. See the GitHub Security Advisory GHSA-8qf9-62x2-82pp for vendor technical details.

Detection Methods for CVE-2026-53766

Indicators of Compromise

Symbolic links inside developer workspace directories whose targets resolve outside the workspace root, especially to /etc, ~/.ssh, ~/.aws, or ~/.config.
Writes by Node.js processes hosting chrome-devtools-mcp to files outside the declared workspace roots.
upload_file MCP tool invocations followed by outbound HTTP transfers from the controlled Chrome instance to untrusted origins.

Detection Strategies

Audit running MCP server processes and confirm the installed chrome-devtools-mcp version is 1.1.0 or later using npm ls chrome-devtools-mcp.
Scan workspace roots for symlinks with find <root> -type l -lname '*' and flag any link whose target lies outside the root.
Inspect MCP server logs for validatePath accepts followed by file operations against paths that resolve through symlinks.

Monitoring Recommendations

Enable filesystem auditing (auditd on Linux, fs.events on macOS) on developer workstations for writes to sensitive paths originating from node processes.
Forward MCP server stdout and stderr to a central log store and alert on file operations targeting paths outside declared roots.
Monitor outbound traffic from headless or DevTools-driven Chrome instances for unexpected POST payloads containing local file contents.

How to Mitigate CVE-2026-53766

Immediate Actions Required

Upgrade chrome-devtools-mcp to version 1.1.0 or later in every project and global install that hosts the MCP server.
Restart any coding agents, IDE plugins, or daemons that loaded the vulnerable version into memory.
Review workspace roots for attacker-controlled or unexpected symlinks and remove links that point outside the root.

Patch Information

The maintainers fixed the issue in chrome-devtools-mcp version 1.1.0. The patch updates McpContext.validatePath() to canonicalize paths with symlink resolution before comparing them against workspace roots. Review the GitHub Security Advisory GHSA-8qf9-62x2-82pp for the full patch notes.

Workarounds

Run the MCP server under a dedicated low-privilege user account whose filesystem access is limited to project directories.
Disallow symbolic link creation in workspace directories where feasible, or scan and remove links before each agent session.
Disable or restrict file-writing and upload_file MCP tools when using untrusted prompts, repositories, or dependencies until the upgrade is deployed.

bash

# Configuration example
npm install chrome-devtools-mcp@^1.1.0
find ./workspace -type l -exec ls -l {} \; | awk '$NF !~ "^'"$PWD"'" {print}'