CVE-2026-106484

Chrome DevTools MCP rewrites an output path after checking workspace boundaries

ChromeDevTools · chrome-devtools-mcp output-file handling

First documented disclosure · Review checkpoint

Summary

An in-workspace symlink can redirect screenshot or other generated output outside the declared workspace.

Severity and exploitation evidence

Medium · numeric CVSS score not recorded. Severity source.

Exploitation not established: The maintainer advisory includes a real MCP/Chrome screenshot reproduction and supporting harnesses. No malicious exploitation or victim compromise is established by the reviewed sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Path validation runs before extension enforcement. The rewritten destination is then written without another canonical-path check.

Conditions required

A suitable symlink inside a declared MCP root, a writable destination outside it, and an output-tool call that rewrites the extension. The CNA describes a local Linux attacker; a remote prompt requires additional workspace or tool influence.

Potential impact

Out-of-root file overwrite under the user's permissions. The original demonstration does not establish remote code execution.

Affected versions and configurations

>=1.1.0 and <1.5.0; earlier releases have the separate CVE-2026-53766 canonicalization flaw.

Fix and mitigation status

1.5.0 for this issue.

Practical next steps

Update to a supported release containing the 1.5.0 fix; validate the final canonical path after all filename transformations and restrict workspace symlinks.

Operating lesson

Enforce filesystem policy at the final write destination, after transformations.

Evidence and limits

Public fix PR 2269 opened June 28 and the fixed release shipped July 3; the detailed advisory was published October 22 and the CNA record October 28. These are one issue, distinct from the earlier roots canonicalization bug. Numeric CVSS is not supplied by the Chrome CNA; its qualitative rating is Medium. The CNA's generic read/write wording is narrowed here to the original advisory's demonstrated overwrite.

Sources