CVE-2026-35643
HIGH SEVERITYCVSS Score & Metrics
Base Score
8.8 / 10
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability Description
OpenClaw before 2026.3.22 contains an unvalidated WebView JavascriptInterface vulnerability allowing attackers to inject arbitrary instructions. Untrusted pages can invoke the canvas bridge to execute malicious code within the Android application context.
Vulnerability Details
Published Date
Last Modified
CWE ID
CWE-940
Source
NVD
Vendor
OpenClaw
Product
OpenClaw
External References
- https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87
- https://github.com/openclaw/openclaw/commit/8b02ef133275be96d8aac2283100016c8a7f32e5
- https://github.com/openclaw/openclaw/security/advisories/GHSA-cxmw-p77q-wchg
- https://www.vulncheck.com/advisories/openclaw-arbitrary-code-execution-via-unvalidated-webview-javascriptinterface
Discussion (0)
Add Comment
No comments yet. Be the first!