OpenClaw versions prior to 2026.4.9 contain a file read vulnerability that allows attackers to bypass navigation guards. This flaw enables attackers to interact with the browser's act/evaluate functions to access or create file:// pages that should be restricted by direct navigation policies.