CVE-2026-53766: Chrome DevTools MCP Symlink Path Traversal Vulnerability

Technical summary

The McpContext.validatePath() function is intended to prevent file operations outside configured workspace roots by checking whether path.resolve(filePath) falls under one of the allowed root paths. However, path.resolve() performs textual path normalization without following or canonicalizing symbolic links. An attacker can create a symlink inside an authorized workspace root that targets a file outside the boundary. During validation, the symlink's path resolves textually to a location within the workspace, passing the check. When downstream code actually reads or writes through the symlink, the filesystem follows it to the out-of-bounds target. This affects both read operations (upload_file tool) and write operations (filePath-writing tools), creating a classic symlink-based directory traversal vulnerability. The flaw exists independently of whether the MCP client declares the roots capability; it is not related to the documented legacy behavior where an undeclared roots capability allows unrestricted access.

Business impact

Organizations using chrome-devtools-mcp to run coding agents risk unauthorized data exposure and file corruption. An attacker with local access—such as a compromised user account or malicious insider—can exfiltrate sensitive configuration files, source code, or secrets from outside the intended sandbox, or corrupt system files and application binaries. For development teams relying on this tool in CI/CD pipelines or shared development environments, the consequence is a weakened sandbox model where workspace boundaries cannot be trusted. This is particularly critical if the agent runs with elevated privileges or handles sensitive data.

Affected systems

Chrome DevTools for agents (chrome-devtools-mcp) versions 0.24.0 through 1.0.x are vulnerable. The issue does not affect version 1.1.0 or later. Any deployment running an affected version and relying on workspace root restrictions for security is at risk, particularly multi-user or CI/CD environments where code agents interact with shared filesystems.

Exploitability

Exploitability requires local access (AV:L) and low complexity; an attacker with privileges sufficient to create symbolic links within a workspace directory can trigger the vulnerability. The attack is deterministic—symlink creation and file path manipulation are straightforward. However, practical impact depends on the agent's file permissions and the sensitivity of files outside the workspace. The vulnerability is not remotely exploitable and does not require user interaction, making it a concern primarily for environments where attackers have OS-level or filesystem access.

Remediation

Upgrade chrome-devtools-mcp to version 1.1.0 or later. This version fixes validatePath() to properly canonicalize symbolic links before enforcing workspace boundaries. Organizations should verify the upgrade in testing environments first and confirm that workspace root restrictions are re-enforced post-patch. For teams unable to upgrade immediately, consider restricting filesystem permissions to prevent unprivileged users from creating symlinks within workspace directories, or isolating the agent process into a chroot or container environment.

Patch guidance

Apply version 1.1.0 or later via your package manager (typically npm for Node.js projects). The patch modifies the path validation logic to resolve symlinks to their canonical targets before checking boundaries. Test in a non-production environment to ensure compatibility with your agent workflows. If you deploy via container, rebuild images with the patched version. Verify post-upgrade that file operations respect workspace boundaries by attempting a test read through a symlink—this should now be blocked.

Detection guidance

Monitor filesystem events for symbolic link creation within workspace directories, especially unexpected symlinks that resolve outside configured roots. Review audit logs for file read/write operations that access paths outside the intended workspace. If using a SIEM, correlate file creation events (symlink setup) with subsequent file access to detect exploitation attempts. During incident response, enumerate symlinks in workspace directories and check their targets; any pointing outside the root is a red flag. Also review logs for any MCP operations that accessed or modified files matching the symlink targets.

Why prioritize this

This is a medium-severity issue requiring prompt but not emergency action. The CVSS score of 6.1 reflects moderate impact (file integrity compromise) and low attack complexity, but requires local access. Prioritize patching if your agents run in multi-user environments, CI/CD pipelines, or systems processing sensitive data. Organizations in isolated single-user development setups face lower risk. The fact that it is not yet in the KEV catalog does not diminish the need for remediation—early patching of sandbox bypasses prevents sophisticated attacks before they are widely exploited.

Risk score, explained

CVSS 6.1 (MEDIUM) reflects: Attack Vector Local (AV:L)—requires filesystem access; Attack Complexity Low (AC:L)—symlink creation is trivial; Privileges Required Low (PR:L)—normal user can create symlinks; User Interaction None (UI:N)—automated; Scope Unchanged (S:U); Confidentiality None (C:N)—symlink itself does not leak data, but read access can; Integrity High (I:H)—files outside the workspace can be overwritten; Availability Low (A:L)—write operations may corrupt availability. The score appropriately reflects a real but constrained threat, appropriate for a sandbox-bypass vulnerability in a development tool.

Frequently asked questions