@ethanwilkins/mcp-chrome-bridge-2026@2.4.4

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

A Chrome/Mozilla extension sends requests to the running local /agent API after the native host starts the server.

Arbitrary attacker-supplied agent instructions can execute with the local user's Codex credentials and filesystem permissions.

unauthenticated extension-origin agent invocation with forced Codex sandbox bypass

On global installation, the package registers a Chrome native host which starts a loopback server. Its CORS policy accepts any installed extension origin, but its authentication hook excludes agent endpoints. A malicious extension can create/select a project and submit an agent action that launches Codex with `--dangerously-bypass-approvals-and-sandbox`; the bundled defaults additionally request danger-full-access and autonomous operation. This is a concrete local privilege/control boundary failure, not merely an optional CLI feature.

The package exposes an unauthenticated cross-extension path to force a local AI coding agent into unrestricted execution. Local-only binding and package-owned native-host registration do not mitigate a malicious installed extension.