PinchTab is a standalone HTTP server that provides AI agents direct control over Chrome browsers. A Server-Side Request Forgery (SSRF) vulnerability was discovered in the /download endpoint prior to version 0.7.7. This vulnerability allows any user with API access to force the PinchTab server to make requests to arbitrary URLs. Attackers can target internal network services and local system files through this flaw. The vulnerability enables full response content exfiltration from targeted systems. The issue has been resolved in PinchTab version 0.7.7.