Openclaw cli: OpenClaw: Arbitrary code execution via unvalidated WebView JavascriptInterface (CVE-2026-35643)
Description
OpenClaw CLI versions prior to 2026.3.22 contain a vulnerability in the Android Canvas WebView component that allows arbitrary code execution via an unvalidated JavascriptInterface bridge. This occurs when WebView pages from untrusted origins invoke the bridge and inject instructions into the app. The issue is fixed in version 2026.3.22 and later.
CVSS v3.1
Score 8.8high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The OpenClaw CLI (npm package 'openclaw') suffers from a security vulnerability (CVE-2026-35643) where Android Canvas WebView pages from untrusted origins can invoke the JavascriptInterface bridge, enabling injection of arbitrary instructions into the application. This vulnerability allows remote attackers to execute arbitrary code. The fix, shipped in version 2026.3.22, involves snapshotting the page origin and rejecting bridge calls from untrusted origins, with centralized trusted origin and path validation implemented in the codebase.
Potential Impact
Successful exploitation of this vulnerability could lead to arbitrary code execution within the context of the OpenClaw CLI application on Android, potentially compromising confidentiality, integrity, and availability. The CVSS v3.1 score is 8.8 (high severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
A patch is available and should be applied by upgrading to OpenClaw CLI version 2026.3.22 or later. The fix is confirmed present in versions 2026.3.22, 2026.3.23, and 2026.3.23-2. Users should update to these versions to mitigate the vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-35643
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 3.1
Threat ID: 6ac245ad12601ec6a3166702
Added to database: 10/04/2026, 12:25:17 UTC
Last enriched: 10/04/2026, 12:55:05 UTC
Last updated: 10/04/2026, 16:08:37 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.