# chrome-devtools-mcp: file writes and fetches left their boundaries

> Two advisories show that chrome-devtools-mcp's roots and URL filters did not hold as boundaries for a browsing agent.

- **Severity:** Low: Minor, hard to exploit or mostly theoretical. Good to know.
- **Category:** Vulnerability
- **Published by:** Chrome DevTools
- **Disclosed:** 2026-10-22
- **CVE:** CVE-2026-106484
- **Affects:** chrome-devtools-mcp
- **Research by:** thesmartshadow, kuranikaran
- **Primary source:** https://github.com/ChromeDevTools/chrome-devtools-mcp/security/advisories/GHSA-5hw5-4q87-m6x9
- **Page:** https://theinjection.dev/items/chrome-devtools-mcp-roots-allowlist-bypasses/

Chrome DevTools published two advisories for chrome-devtools-mcp: a tool write can land outside the configured roots through a symlink, and service-worker fetches ignore the server's URL allowlist. Both fixes shipped in 1.5.0 in July.

## What happened

Chrome DevTools published two moderate advisories for chrome-devtools-mcp on October 22, 2026, both against releases up to 1.4.0. thesmartshadow reported an out-of-root file write, and kuranikaran reported that the server's global URL allowlist and blocklist miss service-worker traffic. The fixes shipped earlier, in version 1.5.0 on July 3, 2026.

## How it works

The out-of-root write turns on the order of two steps: the server validates the caller's output path, rewrites the file extension, then writes to the rewritten path without validating that path again. A request for workspace/report.txt becomes workspace/report.png, and when that name is a symlink pointing outside the root, the write lands outside. The allowlist gap is separate: the policy is applied to normal page targets, so a service worker registered by an allowed page can still fetch a blocked origin, which the reporter demonstrated as blind request forgery.

## Who is affected

Releases 1.1.0 through 1.4.0 carry the roots bypass and 1.2.0 through 1.4.0 the allowlist bypass, so only an agent pinned to an old chrome-devtools-mcp is exposed. The write needs a symlink inside the root, which malicious workspace state or a prompt injection through an extension-enforcing tool such as take_screenshot can reach. Neither advisory reports remote code execution.

## What to do

Move any pinned chrome-devtools-mcp at or below 1.4.0 to the current release, 1.12.0. Stop treating --allowedUrlPattern and --blockedUrlPattern as a network boundary for a browsing agent, and keep internal services off the network the inspected browser can reach.

## Quick facts

- **Affected:** chrome-devtools-mcp 1.1.0 to 1.4.0 (roots bypass); 1.2.0 to 1.4.0 (allowlist bypass)
- **Fixed in:** 1.5.0, released July 3, 2026; current release 1.12.0
- **CVE:** CVE-2026-106484, for the out-of-root write; the allowlist bypass has no CVE
- **CVSS:** 4.7 on the allowlist bypass; none published for the out-of-root write
- **Found by:** thesmartshadow (roots bypass); kuranikaran (allowlist bypass)
- **Disclosed:** October 22, 2026
- **Impact:** Out-of-root file overwrite and blind requests to blocked origins, not remote code execution

## Sources

1. [Roots Bypass Advisory](https://github.com/ChromeDevTools/chrome-devtools-mcp/security/advisories/GHSA-5hw5-4q87-m6x9)
2. [Allowlist Bypass](https://github.com/ChromeDevTools/chrome-devtools-mcp/security/advisories/GHSA-xfxg-8r4q-wj4v)
3. [CVE Record](https://github.com/advisories/GHSA-2mw5-2f2c-v2g3)
4. [Fix in 1.5.0](https://github.com/ChromeDevTools/chrome-devtools-mcp/releases/tag/chrome-devtools-mcp-v1.5.0)