Google Chrome-Devtools-Mcp vulnerabilities

2 CVEs affecting Google Chrome-Devtools-Mcp, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-53766, published 2026-06-24.

More from Google.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-53766, published 2026-06-24. Medium severity, CVSS 6.1. EPSS: 0.1% chance of exploitation in the next 30 days. Chrome DevTools for agents (chrome-devtools-mcp) lets your coding agent control and inspect a live Chrome browser. From 0.24.0 until 1.1.0, McpContext.validatePath() enforces workspace roots by…
• CVE-2026-53765, published 2026-06-24. Medium severity, CVSS 6.1. EPSS: 0.1% chance of exploitation in the next 30 days. Chrome DevTools for agents (chrome-devtools-mcp) lets your coding agent control and inspect a live Chrome browser. From 0.20.0 until 1.1.0, The chrome-devtools-mcp daemon writes its PID file with…