PT-2026-31958 · Openclaw · Openclaw

Cyjhhh · Published 2026-04-10 · Updated 2026-04-10 · CVE-2026-35643

Mitre

CVSS v3.1

8.8

High

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

OpenClaw before 2026.3.22 contains an unvalidated WebView JavascriptInterface vulnerability allowing attackers to inject arbitrary instructions. Untrusted pages can invoke the canvas bridge to execute malicious code within the Android application context.

Fix

Weakness Enumeration

CWE-940

Related Identifiers

CVE-2026-35643

Affected Products

Openclaw

References · 6

• https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87 · Patch
• https://github.com/openclaw/openclaw/commit/8b02ef133275be96d8aac2283100016c8a7f32e5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-35643 · Security Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-cxmw-p77q-wchg · Note
• https://twitter.com/CveFindCom/status/2042659651846549814 · Twitter Post
• https://vulncheck.com/advisories/openclaw-arbitrary-code-execution-via-unvalidated-webview-javascriptinterface · Note