Chrome DevTools for agents (chrome-devtools-mcp) validates workspace roots by checking if the resolved file path textually falls under a configured root, but the resolve function does not canonicalize symbolic links. This oversight allows a symlink inside a permitted root to point to any file outside that root and pass validation. As a result, operations that read from or write to the file path can access or modify files beyond the workspace boundary, exposing confidential data or allowing integrity compromise. The vulnerability can be leveraged for both read and write directions, potentially enabling arbitrary file disclosure or overwrite within the host system.

The flaw exists in Chrome DevTools for agents versions from 0.24.0 up to, but not including, 1.1.0. Version 1.1.0 and later contain a fix that correctly canonicalizes paths before enforcing root restrictions.

The CVSS score of 6.1 indicates moderate severity. The EPSS score is not available, so the probability of exploitation cannot be quantified, but the flaw is not listed in the CISA KEV catalog. The likely attack vector requires an attacker who can run the MCP client or otherwise control the workspace configuration; by creating a malicious symlink at a permitted location, the attacker can read or write arbitrary files. Given the moderate CVSS, the risk is significant for systems that expose the MCP interface to untrusted parties or allow privileged agents to be compromised.