Disclosed weakness · no CVE recorded

Chrome DevTools MCP network restrictions miss service-worker requests

ChromeDevTools · chrome-devtools-mcp global URL allowlist and blocklist

First documented disclosure · Review checkpoint

Summary

An allowed page's service worker can send requests to origins the browser agent's policy forbids.

Severity and exploitation evidence

Medium · 4.7/10 · CVSS 3.1. Severity source.

Exploitation not established: A local controlled test recorded forbidden-origin requests while equivalent page traffic was blocked. No real-world malicious exploitation is established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Network restrictions cover ordinary page requests but do not govern service-worker initiated fetches; detaching the worker target does not block its traffic.

Conditions required

An allowed page can register a service worker while global allowedUrlPattern or blockedUrlPattern controls are in use.

Potential impact

Blind requests to blocked or private-network origins. The report does not demonstrate response-body access, credential theft or code execution.

Affected versions and configurations

The advisory lists >=1.2.0 through 1.4.0 and reproduces 1.2.0.

Fix and mitigation status

Unresolved: the same advisory lists 1.4.0 as both affected and patched. The reviewed 1.4.0 release does not identify a service-worker fix; no corrected version is independently established.

Practical next steps

Enforce egress restrictions outside the browser, or disable service workers when network policy is required. Confirm the exact fix with the maintainer before relying on a version number.

Operating lesson

Browser policy must cover every execution context capable of making network requests.

Evidence and limits

Maintainer advisory GHSA-xfxg-8r4q-wj4v was published October 22 and states no known CVE. Its overlapping affected/patched version metadata is preserved rather than resolved by assumption. This is separate from both file-path CVEs and is not prompt injection.

Sources