CVE-2026-106484: Google chrome-devtools-mcp vulnerability
Published Oct 28, 2026
·Updated
Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux prior to 1.5.0 allowed a local attacker to perform arbitrary read/write via a malicious file. (Chromium security severity: Medium)
Affected Software
1 affected component
Google chrome-devtools-mcp<1.5.0
Event History
Oct 28, 2026
CVE Published
via MITRE·06:04 PM
Data Sourced
via MITRE·06:04 PM
DescriptionWeakness
Frequently Asked Questions
1
Who is exposed to this issue?
Systems running Google chrome-devtools-mcp on Linux with a version earlier than 1.5.0 are affected. Exploitation requires a local attacker and a malicious file.
2
What can an attacker do if exploitation succeeds?
A local attacker could perform arbitrary file reads and writes through insufficient policy enforcement.
3
What version fixes the issue?
Upgrade chrome-devtools-mcp to version 1.5.0 or later.