chrome-devtools-mcp: file writes and fetches left their boundaries

01What happened

Chrome DevTools published two moderate advisories for chrome-devtools-mcp on October 22, 2026, both against releases up to 1.4.0. thesmartshadow reported an out-of-root file write, and kuranikaran reported that the server's global URL allowlist and blocklist miss service-worker traffic. The fixes shipped earlier, in version 1.5.0 on July 3, 2026.

02How it works

The out-of-root write turns on the order of two steps: the server validates the caller's output path, rewrites the file extension, then writes to the rewritten path without validating that path again. A request for workspace/report.txt becomes workspace/report.png, and when that name is a symlink pointing outside the root, the write lands outside. The allowlist gap is separate: the policy is applied to normal page targets, so a service worker registered by an allowed page can still fetch a blocked origin, which the reporter demonstrated as blind request forgery.

03Who is affected

Releases 1.1.0 through 1.4.0 carry the roots bypass and 1.2.0 through 1.4.0 the allowlist bypass, so only an agent pinned to an old chrome-devtools-mcp is exposed. The write needs a symlink inside the root, which malicious workspace state or a prompt injection through an extension-enforcing tool such as take_screenshot can reach. Neither advisory reports remote code execution.

04What to do

Move any pinned chrome-devtools-mcp at or below 1.4.0 to the current release, 1.12.0. Stop treating --allowedUrlPattern and --blockedUrlPattern as a network boundary for a browsing agent, and keep internal services off the network the inspected browser can reach.

Sources 4 links, all fetched

1. 1github.comRoots Bypass Advisory
2. 2github.comAllowlist Bypass
3. 3github.comCVE Record
4. 4github.comFix in 1.5.0