Openclaw cli: OpenClaw: Chrome --no-sandbox disabled OS-level browser sandbox in sandbox browser container (CVE-2026-32046)

OpenClaw CLI's sandbox browser container was configured to launch Chromium with the --no-sandbox flag by default, effectively disabling Chromium's OS-level sandbox protections. This reduces the security isolation of the browser container, making renderer compromises more impactful as they no longer require a separate sandbox escape. The vulnerability affects OpenClaw npm package versions up to 2026.2.19-2. The remediation involves removing the default --no-sandbox flag, requiring explicit opt-in via environment variables, and adding container hash migration and audit checks to ensure container integrity. The fix is planned for release in version 2026.2.21.

Disabling Chromium's OS-level sandbox by default weakens the sandbox browser container's isolation, increasing the potential impact of renderer-side vulnerabilities. An attacker who compromises the renderer process can potentially escalate privileges or cause greater harm without needing to bypass the sandbox separately. This increases the risk associated with renderer bugs in affected OpenClaw versions.

A patch is available and planned for OpenClaw version 2026.2.21 that removes the default --no-sandbox flag and requires explicit opt-in to disable sandboxing. Users should upgrade to this version once released. The update also includes browser container hash migration and security audit checks to detect and safely recreate stale containers. Until the patch is applied, users should avoid running the sandbox browser container with the --no-sandbox flag enabled by default.