mcp-chrome

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:51 PM UTC
• Version: 0.1.1

Overview

This skill is a browser automation bridge for a real Chrome profile, but it exposes live sessions, history, bookmarks, page content, and cookie-backed requests with limited consent and scoping guidance.

Install only if you are comfortable giving an AI-connected tool access to your active Chrome profile, logged-in websites, browsing history, bookmarks, page contents, and browser cookies. Prefer a dedicated Chrome profile with minimal logged-in accounts, pin and verify package and extension versions, and require confirmation before form submissions, clicks, bookmark changes, history searches, network capture, or cookie-backed requests.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:26

Finding

Unpinned Third-Party Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:26-29 and SKILL.md:65-66
Vulnerability Type: Unpinned and mutable third-party dependency execution
Risk Level: Medium

The installation instructions globally install and execute mcp-chrome-bridger without specifying an exact reviewed version or integrity digest:

bash

npm install -g mcp-chrome-bridger
# or
pnpm install -g mcp-chrome-bridger
mcp-chrome-bridger register

The alternative MCP configuration also invokes the package without a pinned version:

json

"command": "npx",
"args": ["mcp-chrome-bridger", "stdio"]

Technical Analysis

Package names without exact versions resolve to mutable releases from the configured package registry. Global installation may execute package lifecycle scripts with the privileges of the invoking user. Similarly, npx can retrieve and execute a registry package that was not included in or reviewed with this project.

The project contains no lockfile, vendored implementation, cryptographic checksum, or package-signature verification that would bind installation to a known artifact. Consequently, compromise of the package publisher, registry account, release process, or dependency chain could cause users to execute attacker-controlled code.

The resulting bridge is particularly sensitive because the documented capabilities include access to an existing Chrome profile, authenticated browser sessions, browsing history, bookmarks, page content, form input, screenshots, and HTTP requests made with browser cookies.

Attack Path

1. An attacker compromises the package publisher, registry account, release pipeline, or a transitive dependency used by mcp-chrome-bridger.
2. The attacker publishes a malicious release under the expected package name.
3. A user follows the documented global installation command, or an MCP client launches the unversioned package through npx.
4. The package manager resolve ...[truncated 1325 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the package to a reviewed exact version in every command, including both installation and execution:

   bash

   npm install -g mcp-chrome-bridger@X.Y.Z
   npx --yes mcp-chrome-bridger@X.Y.Z stdio
   

2. Prefer a project-local dependency with a committed lockfile instead of a global installation.
3. Verify package integrity using trusted checksums, registry integrity metadata, provenance attestations, or signatures.
4. Document the expected package publisher, repository, version, release digest, and verification procedure.
5. Review the package and its transitive dependencies before approving version updates.
6. Use automated dependency scanning and permit updates only after security review.
7. Disable package lifecycle scripts during installation where operationally feasible, and explicitly run only reviewed setup operations.
8. Run the bridge under a dedicated, least-privileged account or sandbox with restricted filesystem, process, and network access.
9. Restrict the bridge to the minimum browser permissions and profiles required for the task; avoid exposing a primary profile containing sensitive authenticated sessions.
10. Pin and verify the separately downloaded Chrome extension release with an exact version and published cryptographic checksum before loading it.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly advertises access to existing Chrome login sessions, browsing history, bookmarks, and network activity, but it does not present prominent user-facing warnings or consent boundaries for these sensitive capabilities. Because it operates on the user’s real browser context, misuse or accidental invocation could expose private data, authenticated account content, or enable actions on behalf of the user across websites.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill’s activation criteria are broad enough to trigger on many ordinary browser-related requests, which can cause an agent to invoke a highly privileged browser-control capability without clear necessity or scoping. In this context, the danger is amplified because the skill can act through the user’s live Chrome profile and authenticated sessions, increasing the chance of unintended access, navigation, form submission, or data exposure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.