Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
ChromeDevTools chrome-devtools-mcp — chrome-devtools-mcp: daemon.pid write follows symlinks in /tmp fallback runtime directory
AV AC PR UI S C I A CVSS EPSS %ile KEV
L L L N U N H L 6.1 .0009 0.8 —
AFFECTED
Product Versions Fixed
chrome-devtools-mcp >= 0.20.0, < 1.1.0 – —
TIMELINE
Jun 10 Reserved by GitHub_M
Jun 24 EXPLOIT PUBLISHED — CVE-2026-53765 (ChromeDevTools chrome-devtools-mcp). Public exploit reference added.
Jun 24 Published (CNA: GitHub_M)
Description
Chrome DevTools for agents (chrome-devtools-mcp) lets your coding agent control and inspect a live Chrome browser. From 0.20.0 until 1.1.0, The chrome-devtools-mcp daemon writes its PID file with fs.writeFileSync() to a deterministic runtime path. On typical macOS environments, and on Linux sessions where $XDG_RUNTIME_DIR is unset, that runtime path falls back to /tmp/chrome-devtools-mcp-<uid>/daemon.pid. Because the write does not use O_NOFOLLOW, a local low-privilege user on the same POSIX host can pre-create /tmp/chrome-devtools-mcp-<victim_uid>/daemon.pid as a symlink to a file writable by the victim. When the victim later starts daemon mode, fs.writeFileSync() follows the symlink and truncates the target file to the daemon PID string. This vulnerability is fixed in 1.1.0.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| June 10, 2026 | Reserved | Reserved by GitHub_M |
| June 24, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-53765 (ChromeDevTools chrome-devtools-mcp). Public exploit reference added. |
| June 24, 2026 | Published | Published (CNA: GitHub_M) |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| ChromeDevTools | chrome-devtools-mcp | — | >= 0.20.0, < 1.1.0 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-53765 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.