PT-2026-23524 · Google+1 · Google Chrome+1

Qi Deng · Published 2026-02-17 · Updated 2026-05-26 · CVE-2026-28395

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.1.14-1 through 2026.2.11

Description The software contains an improper network binding issue in the Chrome extension relay server. The server incorrectly handles wildcard hosts, treating them as loopback addresses. This allows the relay HTTP/WS server to bind to all interfaces when a wildcard cdpUrl is configured. Remote attackers can potentially access relay HTTP endpoints from outside the intended network, which could expose service presence and port information. This could also enable denial-of-service and brute-force attacks against the relay token header. The vulnerable component is the Chrome extension relay server, specifically the ensureChromeExtensionRelayServer function. The cdpUrl variable is a key factor in triggering this issue.

Recommendations Update to version 2026.2.12 or later.

Fix

DoS

Improper Access Control

Weakness Enumeration

CWE-284

CWE-1327

Related Identifiers

CVE-2026-28395

GHSA-QW99-GRCX-4PVM

Affected Products

Google Chrome

Openclaw

References · 14

• https://github.com/openclaw/openclaw/security/advisories/GHSA-qw99-grcx-4pvm · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/8d75a496bf5aaab1755c56cf48502d967c75a1d0 · Patch
• https://github.com/openclaw/openclaw/commit/a1e89afcc19efd641c02b24d66d689f181ae2b5c · Patch
• https://osv.dev/vulnerability/GHSA-qw99-grcx-4pvm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28395 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28395 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.12 · Note
• https://twitter.com/CVEnew/status/2030385197376487670 · Twitter Post
• https://vulncheck.com/advisories/openclaw-unintended-public-binding-of-chrome-extension-relay-via-wildcard-cdpurl · Note
• https://twitter.com/CveFindCom/status/2029688847592792297 · Twitter Post
• https://t.me/cveNotify/164703 · Telegram Post
• https://t.me/cveNotify/154431 · Telegram Post
• https://twitter.com/dailycve/status/2031213928227733847 · Twitter Post