Browser extension security

The MultiClaw Chrome Extension is a Manifest v3 extension for Chrome, Edge, Brave, and other Chromium-based browsers. It records browser workflows and sends the recorded data to the desktop app over localhost. The extension requests only the permissions it needs and does not send anything to the internet.

Permissions

The extension requests six permissions. Each has a specific, limited purpose.

activeTab: Lets the extension interact with the currently active tab when you trigger an action from the popup.

tabs: Lets the extension read tab URLs, titles, and indices across open tabs. Recording uses this to enumerate tabs and attach recording hooks to each one.

scripting: Lets the extension inject the recording content script into a tab when recording begins. This works alongside tabs to capture pages you navigate to during a session.

alarms: Keeps the background service worker alive during long recordings by scheduling a keepalive alarm every 30 seconds.

storage: Stores recording state and captured events in the browser's built-in storage. Recording state (active, paused, or idle) lives in chrome.storage.session and clears when you close the browser. Captured events live in chrome.storage.local and persist until transferred to the desktop app or automatically removed after 7 days, whichever comes first.

unlimitedStorage: Removes the default storage quota so longer recordings do not lose events.

Host permissions and content script

The extension's host permissions cover only http://localhost/* and http://127.0.0.1/*. The extension does not request network access to any external domain.

The content script runs on all pages (<all_urls>) so it can attach recording hooks to any site you visit. Without this scope, the extension would need to re-inject the content script each time you navigate to a new page during a recording — missing page transitions in the process.

Every event handler in the content script checks an isRecording flag before executing. When no recording is active, the handlers exit immediately. No clicks, keystrokes, or page content are captured outside a recording session.

What the extension does not do

• Does not capture while idle: The content script's event handlers are inactive unless a recording is in progress. No data is collected while you browse normally.
• Does not transmit to MultiClaw Cloud directly: The extension communicates only with the desktop app over localhost through a local HTTP relay. The desktop app handles any subsequent sync to MultiClaw Cloud, not the extension.
• Does not store passwords: The content script excludes password input fields (input[type="password"]) from capture.
• Does not access history or bookmarks: The extension has no permissions for browser history or bookmark data.

Data flow during recording

When you start a recording, the content script captures DOM events (clicks, navigation, form inputs, keyboard shortcuts, and scrolls) and forwards them to the background service worker. The service worker buffers events in memory and periodically flushes them to chrome.storage.local to survive service worker restarts.

When you stop and finalize the recording, the extension opens a multiclaw:// deep link to wake the desktop app. It then transfers the complete event log to the desktop app's local relay server (http://127.0.0.1:18799) via an HTTP POST request. The desktop app stores the recording locally at ~/.openclaw/.

Once the transfer succeeds, the extension removes the events from local storage. If the transfer fails — for example, because the desktop app is not running — the events stay in local storage until the next successful transfer or the 7-day expiry. The extension transmits nothing to the internet during this process and communicates only with the desktop app over localhost.

Data retention

Recorded data exists in two storage locations while the extension holds it:

• Session storage (chrome.storage.session): Stores the recording state (active, paused, or idle). This clears automatically when you close the browser.
• Local storage (chrome.storage.local): Stores captured events. These persist until transferred to the desktop app or automatically removed after 7 days, whichever comes first.

After a successful transfer, the extension deletes events from local storage immediately. If the desktop app is unavailable for an extended period, the 7-day expiry acts as a safety net so recorded data does not accumulate indefinitely.

Uninstalling the extension removes all of its stored data from the browser.

Distribution and updates

The MultiClaw Chrome Extension is available from download.multiclaw.io. You install it manually (sideloaded) through your browser's developer mode rather than through the Chrome Web Store. See Install the MultiClaw Chrome Extension for step-by-step instructions.

Because the extension is sideloaded, your browser does not update it automatically. To update, download the latest version from download.multiclaw.io and replace the existing extension files in your browser's extension directory.

Verifying the extension

MultiClaw signs extension artifacts as part of the release process. Download the extension only from download.multiclaw.io to make sure you receive a signed, unmodified package. Do not install extension files obtained from third-party sources.

Source code is not publicly available. To report a security concern, contact security@multiclaw.io.