mcp-chrome

The core functionality involves executing AI-generated or user-provided JavaScript code within the browser (via chrome.scripting.executeScript and `new Function`) and manipulating DOM/network. This inherently carries security risks, as it allows arbitrary code execution and browser control. The `FileHandler` can download files from URLs, which could pose an SSRF risk if the input URL is controlled by a malicious agent, although it generates new filenames and restricts cleanup to a temporary directory. The system offers system-level installation of its native messaging host, requiring administrator/sudo privileges, which is a common but significant permission grant. No obvious hardcoded sensitive secrets were found. The security model relies heavily on the trustworthiness of the AI agent and the inputs it processes, rather than a sandboxed execution environment.