What’s Vulnerable › Vulnerabilities

CVE-2026-102878: mcp-chrome-bridge through 1.0.31 CORS Origin Bypass

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-09-29 · updated 2026-09-30
• Weakness: CWE-346

Description

mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script execution, page content reading, and screenshot capture.

Affected products

• hangwin mcp-chrome-bridge: through 1.0.31

References

• https://github.com/hangwin/mcp-chrome
• https://github.com/hangwin/mcp-chrome/blob/v1.0.0/app/native-server/src/server/index.ts
• https://github.com/hangwin/mcp-chrome/issues/384
• https://www.vulncheck.com/advisories/mcp-chrome-bridge-through-1.0.31-cors-origin-bypass
• https://github.com/hangwin/mcp-chrome/issues/384

Get alerted when CVE-2026-102878 or the next vulnerability affects your stack