chrome-devtools-mcp service worker requests can bypass the global URL allow and block lists
Service-worker initiated fetches bypass chrome-devtools-mcp global URL allowlist/blocklist
chrome-devtools-mcp released a security advisory noting that in versions 1.2.0 to 1.4.0, fetches initiated by service workers are not constrained by --allowedUrlPattern and --blockedUrlPattern, with the fix in version 1.4.0. The PoC shows that ordinary page navigation, page fetch, and image and script subresources pointing to a blocked origin are all blocked, but requests sent by a service worker registered by an allowed page still reach that origin, in both allowlist and blocklist modes. The advisory says this bypasses the configured network boundary and can launch blind request forgery from the browser context to restricted origins such as localhost, private-network hosts or internal metadata endpoints, and recommends applying network policy to service worker targets as well and adding regression tests for service worker requests.
The PoC accompanying the advisory shows that requests initiated by service workers are not constrained by the URL allowlist; agent deployments that use these two switches to isolate intranet addresses can use this to check affected versions.