Security
An agent with access to your logged-in browser is powerful. These are the controls BrowserZap builds in, and how to tell us when one falls short.
Controls
| Risk | What BrowserZap does |
|---|---|
| Another program on your network takes control | The bridge listens on 127.0.0.1 only and refuses to start otherwise. Every connection must present a per-install pairing token, compared in constant time. |
| The agent runs arbitrary code in your pages | There is no "execute JavaScript" tool. Agents get task-level tools (inspect, click, fill, wait, navigate) with validated arguments. |
| A wrong click on a look-alike button | Targets must be unique. An ambiguous target is refused with candidates; nothing is clicked. |
| The agent submits, deletes or pays on its own | Consequential clicks and Enter-submits need your one-time approval in the side panel, bound to that element and site, valid five minutes. |
| A web page tells the agent what to do (prompt injection) | Page content is labelled untrusted in every result. CAPTCHA and sign-in challenges are handed to you, never automated. |
| Secrets end up in logs | Typed values, cookies, tokens and URL query strings are never logged. BrowserZap never types into password, card or one-time-code fields. |
| An agent acts in the wrong account | With several Chrome profiles connected, an agent must choose one; BrowserZap does not guess. |
| You want it to stop | Take control in the side panel, or press Cancel on Chrome's debugging bar: in-flight actions stop, and BrowserZap does not re-attach by itself. |
Report a vulnerability
Email [email protected] with the steps to reproduce, the version (browser_status shows it) and what you expected. Please give us 90 days to fix it before publishing. We acknowledge reports within 3 working days.
In scope: the extension, the bridge and MCP server, BrowserZap Pro and this website. Out of scope: your AI client and its model, and issues that need an attacker already running code as your user.