Executive brief
OpenClaw is a local AI assistant that manages browser profiles and network requests. A flaw allows attackers to bypass security guards on persistent browser profile changes by invoking the browser proxy through an unguarded code path. This could enable unauthorized modification of sensitive browser configurations.
Technical details
OpenClaw implements a `browser.request` guard to prevent unauthorized mutations of persistent browser profiles. However, the `node.invoke(browser.proxy)` method bypasses this guard by routing profile modifications through an unprotected code path, resulting in an incorrect authorization check (CWE-863). The vulnerability requires local access and authenticated use within OpenClaw's trust model. An attacker with access to the local assistant can mutate persistent browser profiles in ways the security boundary was designed to prevent. A patch is available in version 2026.4.8 and later.
Affected products
- OpenClaw OpenClaw <= v2026.04.01
Timeline
- 2026-04-09: disclosed
- 2026-04-08: patched: Patched in version 2026.4.8