Origin Validation Error in mcp-chrome-bridge by Hangwin

CVE-2026-102878

What is CVE-2026-102878?

mcp-chrome-bridge, up to version 1.0.31, has a crucial origin validation flaw in its native-server HTTP API. This vulnerability allows malicious actors to bypass CORS restrictions. Attackers can exploit this weakness by crafting hostile web pages that facilitate cross-origin requests to the local server. This exploitation can lead to unauthorized access to browser automation tools, enabling actions such as script execution, page content extraction, and even screenshot capture, significantly compromising user security and privacy.

References