Arbitrary JavaScript Execution via eval() in...

Arbitrary JavaScript Execution via eval() in chrome-local-mcp Severity: Critical | CWE: CWE-94 (Code Injection) | Package: chrome-local-mcp v1.3.0 We found a critical vulnerability in chrome-local-mcp, a popular MCP server that gives AI agents like Claude full browser control through Puppeteer. The issue is straightforward: an eval tool passes user-supplied JavaScript directly to the browser with zero restrictions. Combined with persistent login sessions, this turns any prompt injection into cre