## Summary
Browser tabs action select and close routes bypassed SSRF policy.
## Affected Packages / Versions
- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `< 2026.4.10`
- Patched versions: `>= 2026.4.10`
## Impact
The browser `/tabs/action` select and close branches could operate on targets without enforcing configured browser SSRF policy, weakening tab-level navigation protections.
## Technical Details
The fix enforces browser SSRF policy in the select and close tab-action branches.
## Fix
The issue was fixed in #63332. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.
## Fix Commit(s)
- `48c0347921b7e9438af0312968fc360ca88023f3`
- PR: #63332
## Release Process Note
Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.
## Credits
Thanks to @tdjackey for reporting this issue.