CVE-2026-53766 is a vulnerability in Chrome DevTools for agents (chrome-devtools-mcp) that allows a workspace-boundary bypass. The vulnerability exists in versions 0.24.0 to 1.1.0 and allows an attacker to overwrite out-of-root files through an in-root symlink or read files through the symlink and send them to the currently selected web page. This vulnerability can be exploited by an attacker to access se [truncated]
A local low-privilege user on the same POSIX host can exploit a symlink vulnerability in Chrome DevTools for agents (chrome-devtools-mcp) from version 0.20.0 until 1.1.0. This allows them to truncate a file writable by the victim when the victim starts daemon mode. The vulnerability arises because the chrome-devtools-mcp daemon writes its PID file with fs.writeFileSync() to a deterministic runtime path, w [truncated]
