Is Kimi WebBridge safe?
Kimi WebBridge lets a local WebSocket service issue browser automation commands through Chrome debugger access.
On startup, the extension connects to ws://127.0.0.1:10086/ws and accepts tool_call messages without token, origin, or pairing validation. Those messages can attach Chrome debugger access to tabs to navigate pages, evaluate code, read page content, capture screenshots or PDFs, inspect network response bodies, and fill forms.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed Kimi WebBridge contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- 127.0.0.1:10086
Kimi WebBridge sends data to 127.0.0.1:10086. No other extension we have analysed sends data here.