OpenClaw Browser Relay Chrome extension security report

OpenClaw Browser Relay is a lightweight Chrome extension that connects your browser to the OpenClaw automation gateway running on your machine. With a single click on any Chrome tab, you attach a local CDP (Chrome DevTools Protocol) relay, which lets OpenClaw drive and observe the tab programmatically. Key benefits: • Local-first automation: all traffic to the relay stays on your device; no data leaves your machine. • Seamless tab attachment/detachment: attach to the active tab, detach when needed, and automatically reattach after navigation. • Robust reliability: built-in reconnect logic, per-tab operation locks, and fallbacks to keep your automation running through browser/workspace restarts. • Developer-friendly: designed to work with OpenClaw’s workflow tools (CRM, scripts, dashboards) to accelerate capital/operational automation without manual clicks. • Safe by design: uses token-based authentication for the relay, with clear guidance on permissions and privacy. What it does (in simple terms) • Installs a local relay server (on your machine) that exposes a controlled WebSocket API to communicate with Chrome. • The extension attaches to a Chrome tab and forwards CDP commands to the relay, enabling automated testing, scraping, or browser automation. • Handles navigation, tab lifecycle, and detach/reattach events to keep automation resilient across typical browser usage. Core features • One-click attach/detach per tab • Persistent state across restarts • Automated reconnects with exponential backoff • Session management for multiple tabs and child sessions • Token-based security to validate the local relay • Easy configuration via a compact options UI (port and gateway token) Ideal for • Teams building automated workflows that interact with web interfaces locally • Developers testing extension interactions or automation scripts • Power users who want repeatable, scriptable browser actions without external servers Requirements • OpenClaw Gateway (local server) running and reachable on localhost • Browser Relay extension installed in Chrome • Gateway token configured in the extension for secure access