VulnSocial

CVE-2026-53765Disclosure(google / chrome-devtools-mcp)

LOWCVSS 6.1 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Chrome DevTools for agents (chrome-devtools-mcp) lets your coding agent control and inspect a live Chrome browser. From 0.20.0 until 1.1.0, The chrome-devtools-mcp daemon writes its PID file with fs.writeFileSync() to a deterministic runtime path. On typical macOS environments, and on Linux sessions where $XDG_RUNTIME_DIR is unset, that runtime path falls back to /tmp/chrome-devtools-mcp-<uid>/daemon.pid. Because the write does not use O_NOFOLLOW, a local low-privilege user on the same POSIX host can pre-create /tmp/chrome-devtools-mcp-<victim_uid>/daemon.pid as a symlink to a file writable by the victim. When the victim later starts daemon mode, fs.writeFileSync() follows the symlink and truncates the target file to the daemon PID string. This vulnerability is fixed in 1.1.0.

google CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Exploit / PoC references
Weakness type (CWE)
CWE-59

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • chrome-devtools-mcp

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
google
Products
chrome-devtools-mcp

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-06-18: 1Technical Details · 2026-06-18: 106-18
Signal classification1 categories
Disclosure
1100.0%
Referenced assets2 URLs
By indicator
Full discourse1 post
  • Mr. OS@ksg93rd
    Disclosure

    CVE-2026-53765: chrome-devtools-mcp agent DevTools daemon PID write follows symlinks in /tmp fallback runtime dir The advisory describes a symlink-following risk in chrome-devtools-mcp: when $XDGRUNTIMEDIR is unset, the daemon writes http://daemon.pid to a deterministic /tmp-based path via fs.writeFileSync(), so an attacker who can pre-place a symlink at that path may redirect the PID write. #AgentSecurity #LLMSecurity #AISecurity #Advisory https://github.com/advisories/GHSA-3pvj-jv98-qhjq

    Post summary

    The advisory identifies a symlink‑following vulnerability in chrome-devtools-mcp that could allow an attacker to redirect daemon PID writes via a pre‑placed symlink; no PoC, exploit code, or patch is mentioned.

    00024408
    3.4K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appgooglechrome-devtools-mcp-node.js-

Explore more

Back to dashboardgoogle CVEschrome-devtools-mcp vulnerabilities