Review bundled browser and Chrome native-host boundary

[nisavid]

Summary

Review Browser Use and Chrome native-host packaging and runtime boundaries.

Source

Migrated from docs/maintainers/security-backlog.md.

Maintained Docs

• Security backlog index and review workflow: docs/maintainers/security-backlog.md
• Threat model: docs/maintainers/threat-model.md
• Package and runtime maintenance: docs/maintainers/package-runtime-maintenance.md

Context

The generated app stages Browser Use resources and the upstream Chrome plugin with Linux native-messaging support for Chrome, Brave, and Chromium. These components run in the user's desktop session and bridge browser state into Codex through local plugin and native-host paths.

Review Gate

Run the @codex-security workflow before treating implementation as review-ready.

Desired State

• Native-messaging manifests and host paths are restricted to packaged assets and expected extension identities.
• Browser profile discovery and launch commands use argument vectors and sanitized inputs.
• Browser Use and Chrome plugin logs avoid persisting page data, tokens, or browser profile paths longer than needed.
• Stale browser, CDP, or native-host clients cannot receive unintended future commands.

[coderabbitai]

🔗 Related PRs

#4 - Security hardening and release verification [merged]
#11 - docs: restore fork docs after PR 10 [merged]
#12 - docs: audit fork divergence docs [merged]
#23 - fix(launcher): address late review findings [merged]
#47 - chore(sync): merge upstream main [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!