Executive brief
OpenClaw is a browser automation library used for scripting and testing web interactions. A flaw in its interaction handling allows an attacker to bypass navigation security policies by triggering file:// page access through browser interaction methods, potentially exposing sensitive local files. This affects automated testing frameworks and bot applications relying on OpenClaw for secure browsing.
Technical details
The vulnerability is a protection mechanism failure (CWE-693) in OpenClaw's browser interaction routes. Browser act/evaluate interactions could trigger navigation into the local Chrome DevTools Protocol (CDP) origin, bypassing direct navigation guards to create or read disallowed file:// pages. The root cause is insufficient URL validation after interaction-driven navigations; the security policy is checked on direct navigation but not re-validated when interactions (click, evaluate, batch operations) cause navigation. An attacker with control over interaction payloads can exploit this with user interaction (UI:A), requiring no authentication. The fix re-checks browser URLs after interaction-driven navigations and blocks targets that violate the configured policy. Patched in versions 2026.4.9 and later.
Affected products
- OpenClaw OpenClaw < 2026.4.9
Timeline
- 2026-04-17: disclosed
- 2026-04-09: patched: Fix merged in PR #63226; v2026.4.9 is first stable release with fix