Unscored severity · published Oct 28, 2026
CVE-2026-106484
Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux prior to 1.5.0 allowed a local attacker to perform arbitrary read/write via a malicious file
New
–
CVSS
–
EPSS
No
On KEV
Description
Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux prior to 1.5.0 allowed a local attacker to perform arbitrary read/write via a malicious file. (Chromium security severity: Medium)
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
chrome-devtools-mcp · Google
1.1.0 before 1.5.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-106484
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-106484
github.com
https://github.com/ChromeDevTools/chrome-devtools-mcp/security/advisories/GHSA-5hw5-4q87-m6x9
More from chrome-devtools-mcp
6.1
CVE-2026-53765
chrome-devtools-mcp: daemon.pid write follows symlinks in /tmp fallback runtime directory
6.1
CVE-2026-53766
chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots