CVE-2026-102878
HIGH
8,6
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A
HIGH
8,1
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: none
Description
AI Translation Available
mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script execution, page content reading, and screenshot capture.
346
Origin Validation Error
DraftCommon Consequences
Security Scopes Affected:
Access Control
Other
Potential Impacts:
Gain Privileges Or Assume Identity
Varies By Context
Applicable Platforms
Technologies:
Not Technology-Specific, Web Based
https://github.com/hangwin/mcp-chrome/issues/384
https://github.com/hangwin/mcp-chrome
https://github.com/hangwin/mcp-chrome/blob/v1.0.0/app/native-server/src/server/…
https://github.com/hangwin/mcp-chrome/issues/384
https://www.vulncheck.com/advisories/mcp-chrome-bridge-through-1.0.31-cors-orig…