Chrome DevTools MCP checked an output path against an allowed workspace before appending an image extension and following a symlink. The attacker needed control of the relevant screenshot output path and a target outside the intended allowed root. A path accepted before extension handling could resolve to another file location for the final image write. Th…
Inspect the ClaimsCase · DiggingBeagle record
Chrome DevTools MCP screenshot extension handling could escape a path allowlist
Chrome DevTools MCP checked an output path against an allowed workspace before appending an image extension and following a symlink. A path accepted before extension handling could resolve to another file location for the final image write.
Scope
The attacker needed control of the relevant screenshot output path and a target outside the intended allowed root. This is an unintended file-write boundary, not arbitrary local-file reading or a demonstrated complete machine takeover.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
The cited primary technical report or advisory supports the stated mechanism within its reported scope. The assessment does not infer a production breach, a victim count or a comparable impact score from a laboratory result. A maintainer or advisory names a patched release; that does not prove every deployed instance has updated. Boundary: This is a check/use mismatch in filesystem path interpretation: an allowed basename can become a different symlink target when the screenshot extension is inserted.
Assessed Oct 29, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP23-CHROME-DEVTOOLS-MCP-SCREENSHOT-1 · CLM-ENRICH-20261029-09 · Chrome DevTools MCP screenshot target-path bypass advisory
At a glance
A path accepted before extension handling could resolve to another file location for the final image write.
Read the implicationsThis is an unintended file-write boundary, not arbitrary local-file reading or a demonstrated complete machine takeover.
Limits and uncertaintyFull account
Chrome DevTools MCP checked an output path against an allowed workspace before appending an image extension and following a symlink.
The attacker needed control of the relevant screenshot output path and a target outside the intended allowed root. A path accepted before extension handling could resolve to another file location for the final image write.
This is an unintended file-write boundary, not arbitrary local-file reading or a demonstrated complete machine takeover. Upgrade chrome-devtools-mcp to 1.5.0 and enforce the final resolved destination on the opened file descriptor.
Evidence interpretation and control boundary. This is a check/use mismatch in filesystem path interpretation: an allowed basename can become a different symlink target when the screenshot extension is inserted. The security condition must be enforced on the final opened destination, after normalization and extension handling, with care for symlink changes. The available proof establishes unintended writes within host permissions, not a successful arbitrary file read.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Claims & evidence
CLM-ENRICH-20261029-09The Chrome DevTools MCP advisory describes validating a screenshot pathname before extension insertion and final symlink resolution, enabling an out-of-root write under an attacker-influenced path.supported
Basis: reported finding
- supportsChrome DevTools MCP screenshot target-path bypass advisoryprimary disclosure
GHSA-5hw5-4q87-m6x9: ensureExtension, symlink path and fixed release
CLM-CP23-CHROME-DEVTOOLS-MCP-SCREENSHOT-1Chrome DevTools MCP checked an output path against an allowed workspace before appending an image extension and following a symlink. The attacker needed control of the relevant screenshot output path and a target outside the intended allowed root. A path accepted before extension handling could resolve to another file location for the final image write.supported
Basis: reported finding
- supportsChrome DevTools MCP screenshot target-path bypass advisoryprimary disclosure
GHSA-5hw5-4q87-m6x9: ensureExtension, symlink path and fixed release
Implications
A path accepted before extension handling could resolve to another file location for the final image write.
Controls and mitigations
- Upgrade chrome-devtools-mcp to 1.5.0 and enforce the final resolved destination on the opened file descriptor.
Unknowns and contradictions
- This is an unintended file-write boundary, not arbitrary local-file reading or a demonstrated complete machine takeover.
Sources and citation
Material revision history
- Oct 29, 2026 · Canonical change recorded · new in release · revision 202