What happened
The ADK Web dev server in Google ADK for Java accepted WebSocket and REST requests from any origin and carried no authentication. Because the server binds localhost but requests originate from the developer's browser, a malicious page can control the locally-running agent, invoke its tools, and read or modify sessions and artifacts. Fixed in 1.13.0. CVSS 7.2, published 2026-10-23.
Why it matters
Browser-to-localhost agent takeover: an AI agent framework whose dev server is silently controllable by any page a developer visits while developing. Agents run tools with the developer's privileges and context, so this enables tool misuse, session/artifact theft and unauthorized agent actions without touching the agent's own code.
Attack vector
The /run_live WebSocket endpoint accepts connections from any origin (hardcoded setAllowedOrigins("*") in ≤1.5.0, default * via adk.web.cors.origins in 1.6.0–1.12.0), and the REST API returns Access-Control-Allow-Origin: * by default. Because the server has no authentication and requests originate from the developer's browser, a cross-origin page can send messages to the agent, trigger tools, stream responses and read/manage sessions and artifacts. In 1.6.0–1.12.0 set adk.web.cors.origins to an explicit allowlist.
Affected systems
com.google.adk:google-adk-dev 0.1.0 before 1.13.0; com.google.adk:google-adk-maven-plugin 0.3.0 before 1.13.0
Mitigation
Upgrade to google-adk-java 1.13.0 (enforces same-origin default for CORS and /run_live, rejects DNS-rebinding over loopback). For 1.6.0–1.12.0 set adk.web.cors.origins to an explicit allowlist of trusted origins; don't browse while the dev agent server is running.