Attack Chain

1. An attacker identifies an autonomous agent or MCP client environment utilizing browse-mcp.
2. The attacker triggers an indirect prompt injection by serving a malicious URL to the agent's browser tool.
3. The agent or malicious client calls the browser_download or browser_save_state function.
4. The attacker provides a crafted save_dir or path argument containing directory traversal (e.g., ../../../home/user/.bashrc).
5. The browser-mcp service fetches content from the attacker-controlled source or writes provided state data.
6. The application performs the write operation at the destination path without path validation.
7. The attacker overwrites a critical configuration file to include malicious commands.
8. Upon file execution or shell initialization, the injected commands run, resulting in full host code execution.

Impact

Successful exploitation allows for arbitrary file write, which can result in full host code execution (HCE). This impacts the security posture of any environment where an autonomous agent utilizes browse-mcp, as it bridges the gap between web-based data retrieval and host filesystem access. There is no indication of mass exploitation, but the vulnerability is highly severe in agentic workflows.

Recommendation

• Immediately upgrade browse-mcp to version 0.8.2 or higher to implement mandatory path confinement.
• If upgrading is not immediately feasible, remove or disable the browser_download, browser_save_state, and browser_load_state tools within the BROWSE_MCP_TOOLS configuration.
• Audit application logs for abnormal path usage or tool calls involving directory traversal patterns (e.g., ".." or absolute paths) when invoking browser management tools.
• Define a hardened configuration by strictly controlling the BROWSE_MCP_HOME environment variable to ensure all state data is constrained to a known, non-sensitive directory.