PT-2026-23794 · Google+1 · Google Chrome+1
Aleister1102
·
Published
2026-03-06
·
Updated
2026-03-25
·
CVE-2026-30834
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
PinchTab versions prior to 0.7.7
Description
PinchTab is a standalone HTTP server designed to provide AI agents with direct control over a Chrome browser. A Server-Side Request Forgery (SSRF) condition exists in the
/download endpoint. This allows a user with API access to force the PinchTab server to make requests to arbitrary URLs, including internal network services and local system files, and then retrieve the full response content. The vulnerability is located in the GET /download?url=<url> handler within the download.go file, specifically at line 78, where the user-controlled url parameter is passed to chromedp.Navigate(dlURL) without proper validation. This allows access to local files using the file:// scheme, internal services, and cloud metadata endpoints. The server then returns the captured response body to the attacker, enabling the exfiltration of sensitive data.Recommendations
Update PinchTab to version 0.7.7 or later.
Exploit
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Google Chrome
Pinchtab