T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:228- Finding
Unauthenticated Chrome DevTools Protocol Exposure Enables Browser Session Takeover
- Content
View full analysis
:9222", "attachOnly": false, "color": "#00AA00" } } } ``` ### Technical Analysis The documented remote setup starts Chrome with a debugging port and the permissive `--remote-allow-origins=*` option, opens TCP port 9222 through the Windows firewall, and connects to the endpoint using an unencrypted `ws://` URL. Chrome DevTools Protocol provides highly privileged control over the browser. Depending on the available targets and Chrome configuration, a connected client can enumerate tabs, inspect page content, execute JavaScript in page contexts, read sensitive information rendered by authenticated applications, and perform browser actions as the logged-in user. The project explicitly describes this browser as the owner's logged-in Chrome session, increasing the sensitivity of the exposed interface. No authentication, encrypted transport, client certificate, tunnel, or source-address restriction is specified. Restricting use to a “trusted network” is only operational guidance and does not establish an access-control boundary. The wildcard origin option also removes an important restriction against untrusted web origins attempting to interact with the debugging service. ### Attack Path 1. A user follows the documented instructions and starts Chrome with remote debugging on port 9222 and wildcard allowed origins. 2. The user permits inbound access to TCP/9222 through the host fi ...[truncated 1447 chars]- Remediation
View remediation