OCTOBER 8, 2026
Live Feed
Back to database
Case File

CVE-2026-102878

HIGH · CVSS 8.1 EPSS 0.24% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-29 · Last synced 2026-10-08

CyberRota Analysis

AI-Generated

The vulnerability in Chrome's mcp-chrome-bridge allows attackers to exploit an origin validation error in the native-server HTTP API, enabling them to bypass CORS restrictions. This could lead to unauthorized cross-origin requests, allowing malicious web pages to execute scripts, read page content, and capture screenshots on the local server. Organizations using affected versions of Chrome should prioritize patching to mitigate the risk of potential data exposure and unauthorized access.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-102878
Severity
HIGH
CVSS
8.1
EPSS
0.24%
Chrome

Original NVD Description

mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script execution, page content reading, and screenshot capture.