{"id":"CVE-2026-106484","aliases":[],"cve":{"records":[{"id":"CVE-2026-106484","source":"Chrome","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-06T18:27:21.817Z","published":"2026-10-28T18:04:06.666Z","modified":"2026-10-29T13:22:37.480Z"}],"publishers":[{"name":"Chrome","role":"CNA","organizationId":"ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28","modified":"2026-10-28T18:12:21.299Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-29T13:22:37.480Z"}],"references":[{"url":"https://github.com/ChromeDevTools/chrome-devtools-mcp/security/advisories/GHSA-5hw5-4q87-m6x9","tags":[],"source":"Chrome"}],"weaknesses":[{"id":"CWE-284","description":"CWE-284 Improper Access Control","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-29T01:52:48.130086Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux prior to 1.5.0 allowed a local attacker to perform arbitrary read/write via…","titleSource":"Chrome","descriptionSource":"Chrome","description":"Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux prior to 1.5.0 allowed a local attacker to perform arbitrary read/write via a malicious file. (Chromium security severity: Medium)","score":4.4,"severity":"medium","published":"2026-10-28T18:04:06.666Z","modified":"2026-10-29T13:22:37.480Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Google","name":"chrome-devtools-mcp","platforms":[],"versions":[{"version":"1.1.0","status":"affected","lessThan":"1.5.0","versionType":"custom"}],"cpes":[],"source":"Chrome","url":"https://www.cve.org/CVERecord?id=CVE-2026-106484"}],"remediation":[],"references":["https://github.com/ChromeDevTools/chrome-devtools-mcp/security/advisories/GHSA-5hw5-4q87-m6x9"],"sources":[{"name":"CVE","id":"CVE-2026-106484","modified":"2026-10-29T13:22:37.480Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-106484"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","score":4.4}],"sourceAffected":[],"observedAt":"2026-10-29T14:13:39.338Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T12:35:34.957Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-29T02:00:31.481Z","attemptedAt":"2026-10-29T02:00:31.481Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-29T02:00:31.167Z","attemptedAt":"2026-10-29T02:00:31.167Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-29T02:00:31.168Z","attemptedAt":"2026-10-29T02:00:31.168Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-29T02:00:31.481Z","attemptedAt":"2026-10-29T02:00:31.481Z"}],"evidence":[{"source":"GitHub Advisory Database","id":"GHSA-2mw5-2f2c-v2g3","url":"https://github.com/advisories/GHSA-2mw5-2f2c-v2g3","modified":"2026-10-28T21:31:24Z","checkedAt":"2026-10-29T02:00:31.167Z"},{"source":"ENISA EUVD","id":"EUVD-2026-112366","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-112366","modified":"Oct 29, 2026, 1:52:51 AM","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","checkedAt":"2026-10-29T02:00:31.168Z"},{"source":"NVD","id":"CVE-2026-106484","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106484","modified":"2026-10-28T19:17:21.860","checkedAt":"2026-10-29T02:00:31.481Z"}],"aiSummary":{"text":"Google Chrome on Linux prior to 1.5.0 has insufficient policy enforcement in chrome-devtools-mcp, allowing a local attacker to perform arbitrary read/write via a malicious file. The weakness is improper access control. A medium severity issue is reported.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:06:37.900Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-106484"}]}}