Advisory published for a roots boundary bypass in Google's Chrome DevTools MCP server, fixed three months earlier

The GitHub Advisory Database published GHSA-8qf9-62x2-82pp on 2026-08-17, the first public write-up of CVE-2026-53766 in chrome-devtools-mcp, the MCP server Google maintains for driving a live Chrome browser from a coding agent. The server ranks fourth on the 2026-08-14 MCP 500.

The flaw is in how the server enforced workspace boundaries. McpContext.validatePath() took the client-declared roots, resolved the requested path with path.resolve(), and checked whether the result started with a root path. path.resolve() normalizes text such as . and ..; it does not call realpath(), so it does not follow symbolic links. A symlink sitting inside a declared root therefore passed the check while pointing anywhere on the filesystem, and the file operations downstream followed it. The advisory is explicit that this applied even when a client declared roots correctly with a non-empty list, which separates it from the documented behaviour where a client that declares no roots gets no restriction.

Both directions were affected. Tools that write to a filePath could overwrite files outside the root, and upload_file could read through the symlink and attach the target to a file input on the page the agent was driving. The advisory lists credentials files, SSH keys and project secrets as the kind of target reachable if such a symlink exists, and notes the upload path leaves no record of the canonical file.

Exploitation depends on a workspace-internal symlink already existing or being creatable by something the user trusts. The reporter proposed a network-vector estimate on that basis; the vector recorded against the CVE is local, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, scoring 6.1 medium.

The fix long predates the advisory. Pull request #2127, "use realpath for MCP roots validation", merged 2026-05-26 and shipped the same day in v1.1.0, listed among that release's fixes with no security framing. NVD published the CVE record on 2026-06-24. Affected versions run from 0.24.0 through 1.0.1; current is 1.7.0, released 2026-08-10. Credit for the report goes to enable7997, who states in the advisory that Google Bug Hunters ruled the finding in scope for its open-source program but not reward-eligible, and asked for it to be filed with the project directly.