Is CVE-2026-102878 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-102878?

CVE-2026-102878 has a CVSS v3 severity of HIGH (8.1).

Back

CVE-2026-102878

Description

mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script execution, page content reading, and screenshot capture.