the weakest point in systems like this is usually the mechanism by which the local process communicates with the browser. it's very hard to secure such a mechan

the weakest point in systems like this is usually the mechanism by which the local process communicates with the browser. it's very hard to secure such a mechanism properly as there's no official API for it this claims to use the chrome devtools debug protocol, which I believe is usually entirely unauthenticated. i would not be surprised if someone can compromise this system via this protocol edit: this happened already with node in the case of CVE-2018-7160