Bundled chrome-devtools-mcp 0.19.0 (browser agent) ships fast-uri 3.1.0, ip-address 10.1.0 and ws 8.19.0, invisible to npm audit #30127

What happened?

While scanning published npm packages for bundled third-party code we found that @google/gemini-cli@0.66.0 (bundle/bundled/chrome-devtools-mcp.mjs) and @google/gemini-cli-core@0.66.0 (dist/bundled/chrome-devtools-mcp.mjs, plus dist/bundled/third_party/index.js) ship the browser agent's MCP server built from chrome-devtools-mcp 0.19.0 (VERSION = "0.19.0", line 229010). The two .mjs files are byte-identical. The bundle comes from the pinned devDependency "chrome-devtools-mcp": "0.19.0" in packages/core/package.json (still 0.19.0 on main) via bundle:browser-mcp, and it inlines these versions (also listed in dist/bundled/third_party/THIRD_PARTY_NOTICES):

• fast-uri 3.1.0:
  • CVE-2026-6321 (GHSA-q3j6-qgpj-74h6): path traversal via percent-encoded dot segments (fixed 3.1.1)
  • CVE-2026-6322 (GHSA-v39h-62p7-jpjc): host confusion via percent-encoded authority delimiters (fixed 3.1.2)
  • CVE-2026-13676 (GHSA-4c8g-83qw-93j6): host confusion via failed IDN canonicalization (fixed 3.1.3)
  • CVE-2026-16221 (GHSA-v2hh-gcrm-f6hx): host confusion via literal backslash authority delimiter (fixed 3.1.4)
  • CVE-2026-18446 (GHSA-7p8r-x3mc-p8w7): host confusion via backslash authority introducer (fixed 3.1.5)
  • CVE-2026-75975 (GHSA-f65p-4m7j-42xc): SSRF via malformed IPv6 normalization (fixed 3.1.6)
  • CVE-2026-76172 (GHSA-jqff-g426-hqxp): host confusion via percent-encoded scheme normalization (fixed 3.1.6)
  • CVE-2026-84292 (GHSA-qw65-cvwx-89v3): authority injection via an unvalidated port in serialize (fixed 3.1.7)
  • CVE-2026-86472 (GHSA-hrr3-gc8f-f4qj): inconsistent host case normalization (fixed 3.1.8)
  • CVE-2026-110095 (GHSA-xhq7-xmqj-769h), CVE-2026-110306 (GHSA-w74x-v6f9-j3xg), CVE-2026-110725 (GHSA-333x-w4r6-6crp): path equivalence, scheme spoofing and scheme injection (fixed 3.1.9)
• ip-address 10.1.0:
  • CVE-2026-42338 (GHSA-v2v4-37r5-5v8g): XSS in Address6 HTML-emitting methods (fixed 10.1.1)
  • CVE-2026-69192 (GHSA-mwp4-54f8-5fhr): Address4 decodes leading-zero octets as decimal (fixed 10.3.1)
  • CVE-2026-101913 (GHSA-rpw4-54j3-4h4q): isLinkLocal() recognizes fe80::/64 rather than fe80::/10 (fixed 10.5.1)
  • CVE-2026-101911 (GHSA-h3mg-xc3c-68pw), CVE-2026-101912 (GHSA-j6r3-76f7-8jcv): unbounded parse diagnostic; cross-family isInSubnet() (fixed 10.7.1)
  • CVE-2026-111997 (GHSA-rxp7-6hxx-x8q5): quadratic zone-identifier matching (fixed 10.7.4)
• ws 8.19.0:
  • CVE-2026-45736 (GHSA-58qx-3vcg-4xpx): uninitialized memory disclosure (fixed 8.20.1)
  • CVE-2026-48779 (GHSA-96hv-2xvq-fx4p): memory exhaustion from tiny fragments and data chunks (fixed 8.21.0)

chrome-devtools-mcp is a devDependency and the bundle declares nothing, so npm audit and SCA tools cannot flag these copies for you or for Gemini CLI users. The Dependabot bumps of chrome-devtools-mcp (#27828 through #28993) were closed automatically, and the fast-uri / ip-address / ws Dependabot PRs touch other lockfile copies, not this bundle.

The SECURITY.md routes security issues to g.co/vulnz. We are opening a regular issue instead because we did not find a way for these copies to lead to an exploit through Gemini CLI:

• fast-uri is used only by the bundled ajv for schema $id/$ref resolution.
• ip-address is used only by the socks proxy client, with addresses from configuration.
• ws is puppeteer's CDP transport to the Chrome endpoint the agent launches or the user configures. close() is never called with a TypedArray reason.

Because the copies ship where dependency audits cannot see them, they are easy to miss. We would suggest updating when convenient.

Checked against the published tarballs on 2026-11-04 (npm latest):

npm pack @google/gemini-cli-core@0.66.0 && tar xzf google-gemini-cli-core-0.66.0.tgz
F=package/dist/bundled/chrome-devtools-mcp.mjs
grep -n 'VERSION = "0\.19\.0"' $F
grep -A2 -E '^Name: (fast-uri|ip-address|ws)$' package/dist/bundled/third_party/THIRD_PARTY_NOTICES | grep Version
grep -c 'reescapeHostDelimiters' $F
grep -c 'maxFragments' $F

Output:

229010:    VERSION = "0.19.0";
Version: 3.1.0
Version: 10.1.0
Version: 8.19.0
0
0

reescapeHostDelimiters (fast-uri 3.1.2) and the maxFragments limit (ws 8.21.0) are absent. @google/gemini-cli@0.66.0 bundle/bundled/chrome-devtools-mcp.mjs has the same SHA-256 as the core file.

What did you expect to happen?

The bundled browser MCP server carries fast-uri >= 3.1.9, ip-address >= 10.7.4 and ws >= 8.21.0.

Client information

Login information

Not applicable.

Anything else we need to know?

Suggested fix: update the chrome-devtools-mcp devDependency in packages/core/package.json to a current release, rebuild bundle:browser-mcp, and check the versions in the new THIRD_PARTY_NOTICES. chrome-devtools-mcp 1.12.0 no longer bundles ip-address and has ws >= 8.21.0. Its main lockfile resolves fast-uri 3.1.9 since ChromeDevTools/chrome-devtools-mcp#3346, so the next release should cover fast-uri as well.