Executive brief
OpenClaw is an application that uses Android WebViews to display content. A security flaw allows malicious websites to bypass security boundaries and execute unauthorized commands within the app. This could lead to the theft of sensitive user data or full control over the application's functions if a user visits a compromised web page.
Technical details
The vulnerability is caused by improper verification of the source of communication (CWE-940) within the Android WebView's JavascriptInterface bridge. Specifically, the 'CanvasScreen' component failed to validate the origin of web pages before allowing them to interact with the bridge. An attacker can exploit this by hosting a malicious page that, when loaded in the app's WebView, invokes bridge methods to execute arbitrary code or commands (CWE-77). The fix, introduced in version 2026.3.22, implements origin snapshotting and centralized validation in 'CanvasActionTrust.kt' to ensure only trusted origins can access the bridge.
Affected products
- OpenClaw openclaw < 2026.3.22
Timeline
- 2026-03-22: patched: Fix released in version 2026.3.22
- 2026-03-26: disclosed: GitHub Advisory published
- 2026-04-10: advisory: NVD published CVE-2026-35643