Origin Validation Flaw in mcp-chrome-bridge Allows CORS Bypass

Executive Summary

mcp-chrome-bridge through version 1.0.31 has an origin validation error in its native-server HTTP API that allows bypassing CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server, enabling script execution, page content reading, and screenshot capture.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your mcp-chrome-bridge server is running and accessible on localhost. Look for unexpected cross-origin requests to local ports. Use tools like curl to test CORS headers: curl -H 'Origin: http://127.0.0.1.evil.com' -I http://localhost:port. Monitor browser developer tools for unauthorized script execution or page content access.

Useful 0 Not Useful 0

Impact Analysis

An attacker can trick you into visiting a malicious page that interacts with your local mcp-chrome-bridge server. This could allow them to control your browser automation tools, access sensitive data like page content, execute scripts, or capture screenshots without your knowledge.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data (e.g., page content, screenshots), potentially violating GDPR's data protection principles or HIPAA's confidentiality requirements. Unauthorized access to user data may result in compliance breaches depending on the context of use.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update mcp-chrome-bridge to the latest version beyond 1.0.31. If updating is not possible, disable the native-server HTTP API or restrict access to localhost only. Add strict origin validation in SERVER_CONFIG.CORS_ORIGIN to prevent wildcard or prefix-based matches. Block external domains from making requests to local ports.

Useful 0 Not Useful 0