RCE in Pinchtab

CVE-2026-33622

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab `v0.8.3` through `v0.8.5` allow arbitrary JavaScript execution through `POST /wait` and `POST /tabs/{id}/wait` when the request uses `…

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.001 (32.6th percentile) — read the EPSS interpretation.

Affected products

  • Pinchtab — versions >= 0.8.3, <= 0.8.5

Weakness classification (CWE)

References