A full-stack security research platform for Google Chrome's WebMCP API, built by VRIL LABS. It covers 15 novel 0-day CVEs disclosed on 2026-08-01, with live detection scanning, offensive simulation, and defensive hardening — all accessible at webmcp.vril.dev.
The potentially novel CVEs detailed in this document were reported to Google on 8/04/2026.
| Module | Description |
|---|---|
| Detection Engine | Fingerprints the browser, analyzes WebMCP exposure, and scores threat level across all 15 CVEs |
| Offensive Engine | Simulates attack vectors — MSTI injection, DOM clobbering, GPU agent proxy, QUIC replay, tool poisoning, and more |
| Defensive Shield | Real-time countermeasures: MSTI shield, session guard, tool integrity verification, WebRTC/GPU protection |
| OSINT Tracer | Generates attribution reports and identifies datacenter ASNs |
| Glow Extension | Chrome extension (chrome-extension/glow) that surfaces MCP security status directly in the browser toolbar |
SW-MCP-PERSIST · GPU-AGENT-PROXY · DOM-CLOBBER-MCP · EXT-MCP-BRIDGE · ANNOTATION-CONFUSION · CSS-KEY-MCP · QUIC-MCP-REPLAY · AUDIO-MCP-FP · MCP-SUPPLY-CHAIN · ELICIT-PHISH · ABORT-RACE · DECL-FORM-HIJACK · CLIENT-INVERT · COMPOSE-XOR · OBSERVE-ORACLE
Full disclosure: BUG-DISCLOSURE.md
- Frontend: Next.js 16 App Router, React 19, TypeScript, Tailwind CSS v4
- Extension: Chrome MV3 (
chrome-extension/glow), TypeScript, esbuild - Infra: Vercel (hosting + edge), Cloudflare (DNS/CDN)
npm install
npm run dev # http://localhost:3000To build the Chrome extension:
cd chrome-extension/glow
npm install
npm run build # outputs to dist/Load dist/ as an unpacked extension in Chrome (chrome://extensions → Developer mode → Load unpacked).
src/
app/ # Next.js App Router pages + API routes
lib/supersayan/ # Core security library
detection-engine.ts # CVE scanning + threat scoring
offensive-engine.ts # Attack vector simulations
defensive-shield.ts # Real-time countermeasures
osint-tracer.ts # Attribution + ASN analysis
components/ # UI components (shadcn/ui)
chrome-extension/
glow/ # Chrome MV3 extension source
See LICENSE.
Built by VRIL LABS · Research disclosed 2026-08-01