Affected: OpenClaw

OpenClaw version 2026.1.20 prior to 2026.2.1 contains a vulnerability in the Browser Relay (extension must be installed and enabled) /cdp WebSocket endpoint in which it does not require authentication tokens, allowing websites to connect via loopback and access sensitive data. Attackers can exploit this by connecting to ws://127.0.0.1:18792/cdp to steal session cookies and execute JavaScript in other browser tabs.

Affected: npm: openclaw, npm: moltbot

### Summary In affected versions, the Browser Relay `/cdp` WebSocket endpoint did not require an authentication token. As a result, a website running in the browser could potentially connect to the local relay (via loopback WebSocket) and use CDP to access cookies from other open tabs and run JavaScript in the context of other tabs.

### Affected Packages / Versions - npm: `openclaw` `>= 2026.1.20, < 2026.2.1` - npm: `moltbot` `<= 0.1.0`

### Details The Chrome extension Browser Relay service exposes a local WebSocket endpoint at `ws://127.0.0.1:18792/cdp` (default port) for forwarding Chrome DevTools Protocol (CDP) messages.

In affected versions, the `/cdp` upgrade path verified the TCP peer was loopback but did not require a shared secret and did not block browser-initiated cross-origin requests.

### Impact - Potential disclosure of sensitive information (for example, session cookies from other open tabs) - Potential JavaScript execution in the context of other open tabs

Users must have the Browser Relay extension installed and active, and must visit an untrusted site.

### Fix `openclaw` now requires a per-instance shared secret header for Browser Relay access: - HTTP header: `x-openclaw-relay-token`

It also rejects `/cdp` WebSocket upgrades when the Origin header is present but is not `chrome-extension://...`, and refuses `/cdp` connections unless the extension is connected.

### Fix Commit(s) - `a1e89afcc19efd641c02b24d66d689f181ae2b5c`

### Releases - `openclaw@202…