CVE-2026-53765: chrome-devtools-mcp Symlink File Truncation (Medium)

Technical summary

The vulnerability stems from insecure file handling in the chrome-devtools-mcp daemon's PID file creation. The daemon uses fs.writeFileSync() to write its process ID to a deterministic path: /tmp/chrome-devtools-mcp-<uid>/daemon.pid on macOS and Linux systems without XDG_RUNTIME_DIR set. The critical flaw is the absence of the O_NOFOLLOW flag during the write operation, which means the kernel will follow symlinks. A local attacker can pre-create a symlink at that path pointing to any file writable by the target user. When the victim starts the daemon, the fs.writeFileSync() call follows the symlink and truncates the destination file, replacing its contents with the daemon's PID. This is a classic symlink-following race condition (CWE-59).

Business impact

Organizations using chrome-devtools-mcp in multi-user Linux or macOS environments face risk of data loss and service disruption. An unprivileged user can corrupt or overwrite files belonging to other users on the system, potentially affecting configuration files, credentials, or application state. In environments where agents run with elevated privileges or where shared systems host sensitive workloads, this could lead to unauthorized modification of important files. Development teams and AI/ML operations relying on this tool should prioritize patching to prevent local users from interfering with each other's workflows or critical system files.

Affected systems

Google chrome-devtools-mcp versions 0.20.0 through 1.0.x are affected. The vulnerability is most relevant on: macOS systems running any version of the affected software, Linux systems where the XDG_RUNTIME_DIR environment variable is not set (causing fallback to /tmp). Windows systems are not affected because they do not use POSIX filesystem semantics or /tmp paths. Environments with strong local access controls or isolated user accounts may see reduced risk, but shared development machines and multi-tenant systems should be considered high-priority targets.

Exploitability

Exploitability is straightforward for attackers with local system access. The attack requires no elevated privileges, no user interaction, and no complex race conditions—only the ability to create a directory and symlink in /tmp before the victim starts the daemon. The predictable path and timing-independent nature of the vulnerability make it highly reliable. However, exploitability is limited to local attacks; remote attackers cannot leverage this directly. An attacker would need prior shell access or a way to write files to the target system.

Remediation

Users must upgrade chrome-devtools-mcp to version 1.1.0 or later, which implements secure file handling for the PID file write. Organizations should: (1) identify all systems running versions 0.20.0 through 1.0.x by checking installed versions and running processes; (2) apply the patch immediately in development and production environments; (3) restart any running daemon instances after patching; (4) review local access policies on shared systems to limit the blast radius of local privilege escalation vulnerabilities. No workarounds are available for earlier versions.

Patch guidance

Upgrade to chrome-devtools-mcp version 1.1.0 or later. Users of npm-based installations should run `npm install chrome-devtools-mcp@latest` or specify `chrome-devtools-mcp@^1.1.0` in package.json and reinstall. For containerized deployments, update the Dockerfile or base image to reference the patched version and rebuild containers. After patching, restart any daemon processes to ensure the new code paths are active. Verify the upgrade by checking the version with `npm list chrome-devtools-mcp` and confirming daemon startup logs show no errors.

Detection guidance

Monitor for exploitation attempts by auditing /tmp for unexpected symlinks or directories matching the pattern chrome-devtools-mcp-* on macOS and Linux systems. Log and alert on suspicious fs.writeFileSync() calls or file truncation events affecting user configuration or credential files. Check process logs for daemon startup failures or PID file errors, which may indicate failed exploitation. In multi-user environments, periodically inventory /tmp to detect malicious symlinks. Collect version information across all systems using the tool to identify unpatched instances. Consider deploying file integrity monitoring on critical files in user home directories to detect unauthorized overwrites.

Why prioritize this

This vulnerability merits prompt patching because it enables local file corruption with moderate impact. Although exploitability requires local access and the CVSS score is Medium (6.1), the attack surface is broad in shared development environments, and the consequences—silent file overwrites—are difficult to detect. The fix is simple and carries minimal risk, making this an efficient use of remediation effort. However, organizations with strong local access controls or isolated user accounts may deprioritize this relative to remote code execution vulnerabilities. Prioritize systems supporting multi-user agent workloads or shared CI/CD platforms.

Risk score, explained

The CVSS 3.1 score of 6.1 (MEDIUM) reflects: Attack Vector Local (no remote exploitation), Access Complexity Low (trivial to exploit once local access exists), Privilege Requirements Low (any local user), User Interaction None (fully automatic), Scope Unchanged (impact contained to the local system), Confidentiality None (no sensitive data exposure), Integrity High (files can be overwritten), Availability Low (potential service disruption from file corruption). The score correctly captures the threat as a local file manipulation vulnerability with meaningful but not critical impact.

Frequently asked questions