Playwright MCP 0.0.81 makes its file access check follow symlinks so a workspace symlink can no longer reach files outside the allowed roots

Microsoft released playwright-mcp v0.0.81 on 2026-09-14. The release notes list the fix first among bug fixes: "The file access check follows symlinks, so a symlink inside the workspace can no longer be used to read or write files outside the allowed roots" (PR #42628). The server restricts file operations to a set of allowed roots; before this release, a symlink placed inside the workspace could point outside those roots and the check would not catch it.

The same release adds tool support for WebMCP: browser_webmcp_list and browser_webmcp_call list and call the tools a page registers through the WebMCP API, and the page status now reports how many such tools are available (PR #42613). Two configuration additions round out the release: --profile-dir-name (env PLAYWRIGHT_MCP_PROFILE_DIR_NAME) selects which Chrome profile to connect to in extension mode when the extension is installed in more than one profile, and headless browsers the server launches are now closed after one hour without a tool call, configurable with --idle-timeout and disabled by passing 0.

The repository carries no GitHub security advisory for the symlink fix; gh api repos/microsoft/playwright-mcp/security-advisories returned an empty list on 2026-09-15. The fix reached users through the ordinary release notes rather than a GHSA record. A comparable defect, a symlink bypass of workspace roots covered by GHSA-8qf9-62x2-82pp / CVE-2026-53766, was disclosed against Google's Chrome DevTools MCP server and fixed in its v1.1.0 release on 2026-05-26.

The server is cataloged.