chrome-devtools-mcp

ChromeDevTools/chrome-devtools-mcp

This tool lets AI assistants control and inspect a live Google Chrome browser to automate web tasks and debug websites. The biggest risk is that a manipulated AI could run code in your open browser tabs, access your login cookies, or read private files on your computer.

What it can reach

Browser

Launches or connects to Chrome to navigate websites, click buttons, run custom JavaScript, install extensions, and read network traffic and login cookies.

Files

Saves screenshots, recordings, and diagnostic reports to disk, and can read local files through browser file links or unrestricted command-line settings.

Network

Connects to any website, fetches source maps, checks npm for updates, and sends usage telemetry and inspected web addresses to Google services by default.

Shell commands

Starts Chrome browsers, background Node.js helper processes, system check utilities, and optional video recording tools like ffmpeg.

Findings

1. HighDefault-enabled file:// navigation bypasses MCP workspace root restrictions

   src/utils/url.ts:132

   While file path parameters on tools are validated against MCP workspace roots and the OS temporary directory, the --file-navigations flag defaults to true and navigation URLs in new_page, navigate_page, and navigate are not checked against McpContext.validatePath(). An attacker using prompt injection can instruct the agent to navigate Chrome to file:// or view-source:file:// URLs outside the allowed workspace roots (such as ~/.ssh or /etc/passwd) and read the file contents using take_snapshot or evaluate_script.

   Fix: Set fileNavigations to false by default, or validate file: navigation targets (including view-source:file:) with context.validatePath() so they respect configured workspace roots.

2. HighCLI mode enables unrestricted filesystem access and extension loading by default

   src/config/ServerConfig.ts:200

   The package ships with a chrome-devtools-cli skill that instructs coding agents to run the chrome-devtools CLI. When the background daemon is started via the CLI (--viaCli), ServerConfig.applyDefaults automatically sets allowUnrestrictedPaths: true and categoryExtensions: true. This disables the workspace root path protections used in MCP mode—allowing upload_file, evaluate_script --sourcePath, and file output flags to read or write anywhere on the filesystem—and enables install_extension to load unpacked Chrome extensions.

   Fix: Do not enable allowUnrestrictedPaths or categoryExtensions by default when viaCli is set; require explicit --workspace, --allow-unrestricted-paths, or --category-extensions flags.

3. MediumDevTools resource loader fetches local files and internal URLs from the server process without origin checks

   src/McpContext.ts:1290

   When sourceMaps is enabled (the default), DevTools loads //# sourceMappingURL= references through McpHostBindingAdapter.loadNetworkResource, which calls McpContext.loadResource() in the Node.js process. Because loadResource() does not check the origin of the page that requested the resource, a remote http: or https: page can reference file:// URLs inside the workspace roots or temp directory, or trigger server-side HTTP requests from the Node.js host that bypass Chrome's Private Network Access restrictions and --proxy-server settings.

   Fix: Disallow file: URLs in loadResource when the request originates from a network page, and route DevTools resource fetches through the browser's network stack or block private/loopback IP ranges.

4. MediumSensitive authentication headers and cookies are exposed to the agent by default

   src/config/mcp-options.ts:271

   redactNetworkHeaders defaults to false. When get_network_request is called on a page, full Cookie, Set-Cookie (including HttpOnly cookies), and Authorization headers are returned in plaintext to the model context. If a user connects the server to an existing browser session (--autoConnect or --browserUrl) or reuses the persistent default profile, a prompt injection on a visited page can read and exfiltrate session credentials.

   Fix: Change the default of redactNetworkHeaders to true so sensitive headers are redacted unless explicitly enabled by the user.

5. MediumCLI mode enables unrestricted filesystem access by default

   skills/chrome-devtools-cli/SKILL.md:27

   When using the CLI workflow taught by the chrome-devtools-cli skill, --allowUnrestrictedPaths is enabled by default. If an agent is influenced by prompt injection on a web page, it can use upload_file to exfiltrate arbitrary local files or overwrite files on disk via --filePath and --outputDirPath.

   Fix: Start the CLI daemon with --allowUnrestrictedPaths=false so file reads and writes are confined to the temporary directory.

6. LowInspected page URLs and usage telemetry are sent to Google services by default

   src/tools/performance.ts:306

   By default (performanceCrux: true and usageStatistics: true), stopping a performance trace sends the full URLs recorded in the trace to the Google CrUX API (https://chromeuxreport.googleapis.com/v1/records:queryRecord), and a detached watchdog process sends usage statistics to Google Clearcut (https://play.googleapis.com/log?format=json_proto). Profiling internal or private web applications will transmit those URLs to Google unless --no-performance-crux and --no-usage-statistics are passed.

   Fix: Make external CrUX lookups and telemetry opt-in by default, or skip CrUX API requests for non-public and internal URLs.

7. LowTroubleshooting skill instructs the agent to read global MCP configuration files

   skills/troubleshooting/SKILL.md:12

   When a connection error occurs, the troubleshooting skill tells the agent to automatically search for and read MCP configuration files, including ~/.claude.json and .mcp.json. These files frequently store API keys and secrets for other MCP servers, which will be loaded into the AI agent's conversation context.

   Fix: Avoid allowing the agent to read ~/.claude.json or redact secrets from MCP configuration files before sharing them with the agent.

8. InfoUsage telemetry and CrUX URL lookups are enabled by default

   README.md:45

   By default, the server sends usage statistics to Google Clearcut, checks the npm registry for updates, and sends URLs from performance traces to the Google CrUX API. Tracing internal or private URLs may disclose those URLs to Google's CrUX endpoint unless disabled.

   Fix: Pass --no-usage-statistics and --no-performance-crux in the server arguments, and set CHROME_DEVTOOLS_MCP_NO_UPDATE_CHECKS=true in the environment if external network calls are undesired.