Description
The chrome-devtools-mcp daemon writes its PID file with fs.writeFileSync() to a deterministic runtime path. On typical macOS environments, and on Linux sessions where $XDG_RUNTIME_DIR is unset, that runtime path falls back to /tmp/chrome-devtools-mcp-<uid>/daemon.pid.
Recommendation
Update the chrome-devtools-mcp package to the latest compatible version. Followings are version details:
- Affected version(s): >= 0.20.0, <= 1.0.1
- Patched version(s): 1.1.0
References
Could your website be exposed too?
SmartScanner can check your website for Chrome DevTools for agents: daemon.pid write follows symlinks in /tmp fallback runtime directory and gives you actionable findings to investigate.
Start a free scanRelated Issues
- SillyTavern has a path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory - CVE-2026-34522
- Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file write and directory read - CVE-2026-40163
- Cloudflare Agents is Vulnerable to Reflected Cross-Site Scripting in the AI Playground's OAuth callback handler - CVE-2026-1721
- Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/solid-router-devtools - CVE-2026-45321
You might also like:
See something that needs correcting? Let us knowUpdated July 21, 2026