Vulnerability Description
OpenClaw before 2026.3.22 contains an unvalidated WebView JavascriptInterface vulnerability allowing attackers to inject arbitrary instructions. Untrusted pages can invoke the canvas bridge to execute malicious code within the Android application context.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openclaw | Openclaw | < 2026.3.22 |
Related Weaknesses (CWE)
References
- https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dPatch
- https://github.com/openclaw/openclaw/commit/8b02ef133275be96d8aac2283100016c8a7fPatch
- https://github.com/openclaw/openclaw/security/advisories/GHSA-cxmw-p77q-wchgVendor Advisory
- https://www.vulncheck.com/advisories/openclaw-arbitrary-code-execution-via-unvalThird Party Advisory
FAQ
What is CVE-2026-35643?
CVE-2026-35643 is a vulnerability with a CVSS score of 8.8 (HIGH). OpenClaw before 2026.3.22 contains an unvalidated WebView JavascriptInterface vulnerability allowing attackers to inject arbitrary instructions. Untrusted pages can invoke the canvas bridge to execute...
How severe is CVE-2026-35643?
CVE-2026-35643 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-35643?
Check the references section above for vendor advisories and patch information. Affected products include: Openclaw Openclaw.