MultiSig Connect v1.0.2

Read-only Sui multisig wallet connector — holds no keys, never signs.

Version bumped from 1.0.1 to 1.0.2 to fix a Chrome Web Store rejection:
the manifest requested the tabs permission without using any API that
requires it. The only tabs.* call in the extension is
browser.tabs.create (open the web app in a new tab), which is exempt
from the permission. No functional change versus 1.0.1.

Install (manual, while Web Store review is pending)

1. Download multisig-suisec-extension-1.0.2-chrome.zip below.
2. Unzip it (you'll get a folder with manifest.json).
3. Open chrome://extensions → enable Developer mode → Load unpacked → select the unzipped folder.

Verify your download (SHA-256)

a03ca1a925efa53f5a2e3ee9aefd60e7f1db7c122a47dd7e4a195a205508b76e

macOS/Linux: shasum -a 256 multisig-suisec-extension-1.0.2-chrome.zip
Windows: Get-FileHash multisig-suisec-extension-1.0.2-chrome.zip -Algorithm SHA256

The output must match the hash above.

MultiSig Connect v1.0.1

Read-only Sui multisig wallet connector — holds no keys, never signs.

Version bumped from 1.0.0 to 1.0.1 so the security-hardened build can be
re-uploaded to the Chrome Web Store (which requires a strictly higher version
than the previously submitted package). No functional change versus the
hardened 1.0.0 source.

Security-review hardening included in this build:

• Captured signing-request origins are validated from the browser-stamped event origin and gated to a configured multisig address (no spoofed approval screens).
• The user's private multisig labels are no longer broadcast to pages; the config bridge carries only the on-chain-public address + public key and is removed from the DOM after use.
• The MultiSig app URL (sync trust anchor) is constrained to https, the sync sender origin is re-checked in the background, and the synced multisig list is structurally validated before use.

Install (manual, while Web Store review is pending)

1. Download multisig-suisec-extension-1.0.1-chrome.zip below.
2. Unzip it (you'll get a folder with manifest.json).
3. Open chrome://extensions → enable Developer mode → Load unpacked → select the unzipped folder.

Verify your download (SHA-256)

3f55644d93556d717b7bb56d60f939c432b69dfb272df74f1674864d1af74e74

macOS/Linux: shasum -a 256 multisig-suisec-extension-1.0.1-chrome.zip
Windows: Get-FileHash multisig-suisec-extension-1.0.1-chrome.zip -Algorithm SHA256

The output must match the hash above.