CVE-2026-53766

Chrome DevTools MCP accepts symlinks outside the declared workspace

ChromeDevTools · chrome-devtools-mcp roots validation

First documented disclosure · Review checkpoint

Summary

Textual path checks can permit reading or overwriting files outside configured MCP roots.

Severity and exploitation evidence

Medium · 6.1/10 · CVSS 3.1. Severity source.

Exploitation not established: The advisory's lab reproduction demonstrates the validation/write flaw; it describes the upload path but offers a full MCP reproduction on request. No confirmed malicious exploitation is established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The validator normalizes path text but does not resolve symlinks before checking the workspace prefix. Downstream reads and writes follow the link.

Conditions required

An MCP client declaring nonempty roots, an in-root symlink to an out-of-root file and a relevant tool call. A remote prompt-based chain additionally needs untrusted content and a pre-existing symlink or another tool able to create one.

Potential impact

Workspace boundary bypass: out-of-root writes and potential file upload to the selected browser page, limited by host-user permissions.

Affected versions and configurations

>=0.24.0 and <1.1.0.

Fix and mitigation status

1.1.0 for this canonicalization defect; later CVE-2026-106484 requires its own 1.5.0 fix.

Practical next steps

Use a supported release containing both roots fixes; canonicalize file and parent paths before root checks and restrict symlink creation.

Operating lesson

A workspace path prefix is not a filesystem confinement boundary.

Evidence and limits

Public roots-validation PR 2127 and release 1.1.0 are dated May 26; the advisory followed June 16 and the CNA June 24. This historical backfill is separate from the extension-rewrite bypass. It does not describe the documented missing-roots behavior.

Sources