[SECURITY] Critical: Multiple Arbitrary JavaScript Execution Vulnerabilities in MCP Browser Tools

[Correctover]

Responsible Disclosure — Please treat as confidential

Reporter: Guigui Wang (Correctover)
Contact: wangguigui@correctover.com
CVE requested: Yes (pending)

---

Summary

4 vulnerabilities found in app/chrome-extension/entrypoints/background/tools/browser/ that allow arbitrary JavaScript execution, unrestricted CDP access, and persistent backdoor injection via MCP tool calls.

---

Vulnerability 1: Arbitrary JS Execution via inject-script (P0, CVSS 9.8)

File: tools/browser/inject-script.ts:93-103
CWE: CWE-94

new Function(code)() executes arbitrary JavaScript from MCP tool input without validation. MAIN world injection can access cookies, localStorage, and DOM of any page.

await chrome.scripting.executeScript({
  target: { tabId },
  func: (code) => new Function(code)(),
  args: [jsScript],  // unsanitized MCP input
  world: ExecutionWorld.MAIN,
});

Vulnerability 2: CDP Runtime.evaluate Arbitrary Code Execution (P0, CVSS 9.8)

File: tools/browser/javascript.ts:221-240, 304-320
CWE: CWE-94

CDP Runtime.evaluate receives user code directly. Scripting fallback uses AsyncFunction constructor. Both paths allow full browser control.

// CDP path
await cdpSessionManager.sendCommand(tabId, "Runtime.evaluate", {
  expression: code,  // unsanitized user code
});

// Fallback path  
const AsyncFunction = Object.getPrototypeOf(async function(){}).constructor;
const fn = new AsyncFunction(userCode);

Vulnerability 3: Unrestricted CDP Protocol Access (P1, CVSS 7.5)

File: utils/cdp-session-manager.ts
CWE: CWE-284

sendCommand(tabId, method, params) accepts any CDP method string with no whitelist. Exposes Runtime, Network, DOM, Page, Fetch — full browser control surface.

Vulnerability 4: Persistent Userscript Backdoor (P0, CVSS 9.1)

File: tools/browser/userscript.ts:270, 280
CWE: CWE-94

Scripts injected via userscript tool persist in chrome.storage.local, execute on every page load (default <all_urls>), survive browser restart. Combined with Vuln 1-3 = complete browser compromise.

---

Attack Chain

Vuln 4 (persistent injection) + Vuln 2 (CDP evaluate) + Vuln 3 (unrestricted CDP) = attacker can:

1. Install persistent backdoor on all websites
2. Steal all cookies/sessions/tokens
3. Intercept all network traffic
4. Maintain access across browser restarts

Impact

All ~12,000 users of mcp-chrome are at risk. MCP tool inputs are the attack surface — any malicious MCP client can trigger these.

Suggested Fix

1. Implement CSP/sandbox for script execution
2. Whitelist allowed CDP methods
3. Require explicit user authorization for script execution tools
4. Add input validation and sanitization

Environment

• mcp-chrome version: latest (main branch)
• Discovery method: Source code audit
• PoC available upon request

---

I am disclosing this responsibly. Please confirm receipt and let me know your preferred timeline for patching. I will hold CVE details for 90 days per industry standard.