The Chrome DevTools MCP integration exposes browser operations to agents while intending to constrain navigation and network destinations through URL patterns. A service worker can intercept requests and deliver content under a controlled scope, creating a path that may not be checked at the same point as ordinary navigation. The advisory reports that…
Inspect the ClaimsCase · DiggingBeagle record
Chrome DevTools MCP URL restrictions missed service worker interception paths
A Chrome DevTools MCP advisory showed service worker traffic could bypass configured blockedUrlPattern or allowedUrlPattern checks.
Agent authorityAgent isolation requires bounding indirect outbound authority through allowed services
Scope
An affected Chrome DevTools MCP integration with URL pattern controls and a cooperating service worker; exploitation and fixed-version coverage depend on the advisory environment.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- AI role
- AGAINST AI
Basis and provenance
The advisory demonstrates a service-worker policy bypass. No production victim or independently checked fixed build is asserted. Impact remains unrated because the scoped record does not establish a calibrated severity-to-impact-band mapping.
Assessed Oct 31, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-C26-CHROME-DEVTOOLS-MCP-SW-1 · Chrome DevTools MCP: service worker origin and URL allowlist bypass
At a glance
A checked navigation string and the resource actually reached after service-worker routing are not necessarily the same security object.
Read the implicationsThe number of deployed MCP clients with the affected URL policy enabled is not known. No verified in-the-wild agent compromise was reported.
Limits and uncertaintyFull account
The Chrome DevTools MCP integration exposes browser operations to agents while intending to constrain navigation and network destinations through URL patterns. A service worker can intercept requests and deliver content under a controlled scope, creating a path that may not be checked at the same point as ordinary navigation. The advisory reports that blockedUrlPattern and allowedUrlPattern protections could be bypassed through this mechanism. The crucial distinction is between the URL requested by the agent and the effective content or network action after browser routing.
The report is a vulnerability disclosure, not evidence of a specific victim’s browser being driven to an unauthorized destination. Verification requires matched cases with and without a service worker, checking the actual request and response path against the policy. An allowlist applied only to an initial URL string is insufficient if later browser delegation can change the resource reached.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Timeline
- Oct 29, 2026disclosure
Public disclosure
Claims & evidence
CLM-C26-CHROME-DEVTOOLS-MCP-SW-1The Chrome DevTools MCP advisory identifies a service worker route that bypasses configured blocked and allowed URL pattern checks.supported
Basis: reported finding
- supportsChrome DevTools MCP: service worker origin and URL allowlist bypassprimary disclosure
GHSA-xfxg-8r4q-wj4v, service worker URL restriction bypass description and fix
Implications
A checked navigation string and the resource actually reached after service-worker routing are not necessarily the same security object.
Controls and mitigations
- Apply policy to final network destinations after browser redirects and worker interception, and test allowed and denied URLs under a controlled worker.
Unknowns and contradictions
- The number of deployed MCP clients with the affected URL policy enabled is not known.
- No verified in-the-wild agent compromise was reported.
Sources and citation
Material revision history
- Oct 31, 2026 · Canonical change recorded · new in release · revision 208