Chrome Bridge (frsorrentino) MCP Server

In the server's implementation (`extension/service-worker.js:560`): Evaluating a runtime value as code (rather than a fixed literal) executes whatever reaches it — a direct RCE primitive, and almost never necessary in legitimate code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ch { try { fn = new Function(userCode); } catch (e) { return { ok: false, error: String(e?.message ||

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server extension/service-worker.js

In the server's implementation (`extension/service-worker.js:558`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try { fn = new Function(`return (${userCode});`); } catch { try { fn = new Function(userCode)

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server extension/service-worker.js

In the server's implementation (`server/launcher.js:10`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rt { spawn } from 'node:child_process'; import { cp, mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'; import { e

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server server/launcher.js

Untrusted-input tools ([get_page_info, monitor_network]) co-exist with external-action tools ([upload_file, http_request]). A prompt injection could cause unwanted external actions, though no direct sensitive-data leak path was found.

Evidence: untrusted [get_page_info, monitor_network] → sinks [upload_file, http_request]

Fix: Require confirmation for state-changing/egress actions triggered after processing untrusted content.

Location: flow get_page_info → upload_file

In a packaging/dev/install script (shipped, but not the server runtime) (`tools/cws-upload.mjs:115`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ) { const res = await fetch('https://oauth2.googleapis.com/token', { method: 'POST', headers: { 'Content-Type'

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tools/cws-upload.mjs