CVE-2026-106484: vulnerability facts

CVE-2026-106484

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux prior to 1.5.0 allowed a local attacker to perform arbitrary read/write via a malicious file. (Chromium security severity: Medium)

CVSS 4.4 · Medium · EPSS 0.1% · Fix available

Published: 2026-10-28T18:04:06.666Z
Updated: 2026-10-29T13:22:37.480Z

Affected products and versions

chrome-devtools-mcp
Versions
- ≥ 1.1.0, < 1.5.0: Affected (custom)
Update to 1.5.0

Original sources

https://github.com/ChromeDevTools/chrome-devtools-mcp/security/advisories/GHSA-5hw5-4q87-m6x9
https://nvd.nist.gov/vuln/detail/CVE-2026-106484

Check your server →