Logo
Retour à la veille

CVE-2026-102878

Publié : 29 septembre 2026
Modifié : 29 septembre 2026
Lien officiel NVD
Score CVSS
8.1
HIGH

Description détaillée

mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script execution, page content reading, and screenshot capture.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Références et Patchs

https://github.com/hangwin/mcp-chromehttps://github.com/hangwin/mcp-chrome/blob/v1.0.0/app/native-server/src/server/index.tshttps://github.com/hangwin/mcp-chrome/issues/384https://www.vulncheck.com/advisories/mcp-chrome-bridge-through-1.0.31-cors-origin-bypasshttps://github.com/hangwin/mcp-chrome/issues/384

Dernières Vulnérabilités

CVE-2026-15278

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

VOIR DÉTAILS

CVE-2026-103047

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth extension allows Stored XSS. This issue affects Mediawiki - CentralAuth extension: before 1.46.1, 1.45.5, 1.43.10.

VOIR DÉTAILS

CVE-2026-103046

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - WikiLambda extension allows Stored XSS. This issue affects MediaWiki - WikiLambda extension: before 1.46.1.

VOIR DÉTAILS