Description
mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script execution, page content reading, and screenshot capture.
Published: 2026-09-29
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

mcp-chrome-bridge uses a native-server HTTP API that incorrectly validates the Origin header. An attacker can craft a malicious web page that sends cross‑origin requests to the local server and cause the server to execute browser automation commands, read page content, or capture screenshots. The flaw therefore permits remote code execution or privilege escalation on the machine running the server, as the attacker can trigger arbitrary browser actions.

Affected Systems

Vendor: hangwin; product: mcp‑chrome‑bridge; affected releases up to version 1.0.31 inclusive. Versions newer than 1.0.31 are presumed to contain the fix for the origin validation error.

Risk and Exploitability

CVSS score of 8.6 highlights a high severity, though the EPSS score is not available and it is not listed in the CISA KEV catalog. Attackers would need to host or embed a malicious page on the victim's machine and have the victim open that page while the local mcp‑chrome‑bridge server is reachable. The low to medium exploitation probability suggests limited passive exploitation, but the impact remains significant if the vulnerability is leveraged.

Generated by OpenCVE AI on September 30, 2026 at 10:53 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade mcp‑chrome‑bridge to version 1.0.32 or later where the origin check has been corrected.
  • If an upgrade is not immediately possible, restrict the native‑server’s listening interface to localhost only and block inbound connections from untrusted networks.
  • Disable or remove the browser automation functionality until a patch is applied, or enforce strict origin validation in the server configuration if such an option exists.

Generated by OpenCVE AI on September 30, 2026 at 10:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Hangwin
Hangwin mcp-chrome-bridge
Vendors & Products Hangwin
Hangwin mcp-chrome-bridge

Tue, 29 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script execution, page content reading, and screenshot capture.
Title mcp-chrome-bridge through 1.0.31 CORS Origin Bypass
Weaknesses CWE-346
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Hangwin Mcp-chrome-bridge
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-29T20:19:14.663Z

Reserved: 2026-09-29T17:33:19.455Z

Link: CVE-2026-102878

cve-icon Vulnrichment

Updated: 2026-09-29T20:19:07.617Z

cve-icon NVD

Status : Deferred

Published: 2026-09-29T20:17:18.620

Modified: 2026-09-30T17:32:07.107

Link: CVE-2026-102878

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T20:35:45Z

Weaknesses