CVE-2026-33622: PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab `v0.8.3` through `v0.8.5` allow arbitrary JavaScript…

PriorityP261high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

0.51%

39.7th percentile

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab `v0.8.3` through `v0.8.5` allow arbitrary JavaScript execution through `POST /wait` and `POST /tabs/{id}/wait` when the request uses `fn` mode, even if `security.allowEvaluate` is disabled. `POST /evaluate` correctly enforces the `security.allowEvaluate` guard, which is disabled by default. However, in the affected releases, `POST /wait` accepted a user-controlled `fn` expression, embedded it directly into executable JavaScript, and evaluated it in the browser context without checking the same policy. This is a security-policy bypass rather than a separate authentication bypass. Exploitation still requires authenticated API access, but a caller with the server token can execute arbitrary JavaScript in a tab context even when the operator explicitly disabled JavaScript evaluation. The current worktree fixes this by applying the same policy boundary to `fn` mode in `/wait` that already exists on `/evaluate`, while preserving the non-code wait modes. As of time of publication, a patched version is not yet available.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
github.com	pinchtab_pinchtab	>= 0.8.3	—
github.com	pinchtab_pinchtab_cmd_pinchtab	0.8.3 – 0.8.5	—
pinchtab	pinchtab	—	—
pinchtab	pinchtab	0.8.3 – 0.8.5	—

Detection & IOCsextracted from sources · hover to see the quote

→Correlate authenticated API calls using a server token to /wait endpoints with fn mode payloads, as exploitation requires authenticated access but allows arbitrary JavaScript execution in a browser tab context

·As of publication, no patched version is available; affected versions are v0.8.3 through v0.8.5 of github.com/pinchtab/pinchtab
·This is a security-policy bypass, not an authentication bypass — the attack vector still requires a valid server token for API access

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv4.06.1MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.