Executive brief
OpenClaw's Browser Relay is a Chrome extension that provides local access to browser debugging features. The /cdp WebSocket endpoint lacked authentication, allowing malicious websites to intercept session cookies from other browser tabs and execute arbitrary JavaScript in their context. Users had to have the extension installed and visit an untrusted site to be compromised.
Technical details
The Browser Relay /cdp WebSocket endpoint (ws://127.0.0.1:18792/cdp) performed loopback IP validation but failed to verify authentication tokens and did not properly block cross-origin browser requests. An attacker could open a WebSocket connection from a website and send Chrome DevTools Protocol (CDP) commands to access cookies and run JavaScript in other open tabs. The vulnerability affects openclaw versions >= 2026.1.20 and < 2026.2.1, as well as moltbot <= 0.1.0. The fix, released in openclaw 2026.2.1, adds per-instance authentication via the x-openclaw-relay-token HTTP header, blocks non-extension Origin headers, and requires active extension connection.
Affected products
- OpenClaw Browser Relay >= 2026.1.20, < 2026.2.1
- OpenClaw moltbot <= 0.1.0
Timeline
- 2026-02-17: disclosed: GHSA advisory published
- 2026-02-17: patched: openclaw 2026.2.1 released with fix