High-risk tools in Chrome Devtools
12 of the 47 tools in Chrome Devtools are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at high risk
-
clear_consoleExecuteClear the browser console. Returns: Status of the clear operation
-
connect_to_browserExecuteConnect to an existing Chrome instance with remote debugging enabled. Establishes a connection to a Chrome browser that's already running with remote debugging ...
-
evaluate_in_all_framesExecuteExecute JavaScript code in all frames/iframes of the page. Args: code: JavaScript code to execute Returns: Results from all frames
-
execute_javascriptExecuteExecute JavaScript code in the browser context. Args: code: JavaScript code to execute Returns: Result of the JavaScript execution
-
focus_elementExecuteFocus a DOM element. Args: node_id: Node ID of the element to focus Returns: Success status of the focus operation
-
inspect_console_objectExecuteInspect a JavaScript object or expression in detail. Args: expression: JavaScript expression to inspect Returns: Detailed object inspec...
-
navigate_to_urlExecuteNavigate the connected browser to a specific URL. Instructs the currently connected Chrome instance to navigate to the specified URL. The function waits briefly...
-
override_storage_quotaExecuteOverride storage quota for a specific origin. Args: origin: Security origin to override quota for quota_size_mb: New quota size in MB (optional,...
-
start_chromeExecuteStart Chrome with remote debugging enabled and optionally establish connection. Launches Chrome browser with DevTools Protocol debugging enabled on the specified port. ...
-
start_chrome_and_connectExecuteStart Chrome with debugging, connect, and navigate to URL in one step. Convenience function that combines browser startup, connection establishment, and navigat...
-
start_css_coverage_trackingExecuteStart tracking CSS rule usage for coverage analysis. Returns: Status of coverage tracking initialization
-
track_indexeddbExecuteEnable or disable IndexedDB tracking for an origin. Args: origin: Security origin to track enable: Whether to enable or disable tracking ...
Attacks that target this class
High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.