The report
The Chrome DevTools MCP security advisory describes a gap in global --allowedUrlPattern and --blockedUrlPattern controls. In affected configurations, a service worker registered by content the agent browsed could initiate requests outside the policy expected by its operator. The difference is between the displayed page URL and the lower-level network requests it can cause, not simply a string-matching mistake in a user prompt.
A page may look compliant while another execution context requests a different origin. That does not establish access to every internal endpoint; the effect depends on worker registration, browser routing and reachable destinations. The original advisory describes the affected execution context and relevant fixes, while the canonical investigation keeps the scope of the demonstrated bypass separate from speculative cloud-metadata theft.
A correct policy test must cover page navigation, subresources, service workers and redirected requests under the same restrictions. Inspecting only the main document's URL or a successful tool return leaves the worker path untested. The same principle appears in desktop-browser file handling, but this advisory concerns an MCP browser network-policy boundary, not the EMBRACE local-file read vulnerability.