CVE-2026-35643

OpenClaw before 2026.3.22 contains an unvalidated WebView JavascriptInterface vulnerability allowing attackers to inject arbitrary instructions. Untrusted pages can invoke the canvas bridge to execute malicious code within the Android application context.

Scoring

Severity

HIGH

CVSS base score

8.8

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS probability

0.36%

CWE

CWE-940

Published

2026-04-10

Last modified

2026-06-23

Affected products

• OpenClaw OpenClaw
• OpenClaw OpenClaw

Weakness type

• CWE-940

Related vulnerabilities

• CVE-2026-85085 — The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged...
• CVE-2026-78685 — Le-yan｜Medical Practice Management System - Remote Code Execution
• CVE-2026-73419 — NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them
• CVE-2026-55660 — TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover
• CVE-2026-54106 — U.S. GAO EPDS and CBCA EDS network access control bypass
• CVE-2026-48745 — Traccar Client: silent configuration hijack via unverified deep link redirects all GPS telemetry
• CVE-2026-44894 — Netty's Default QUIC token handler accepts any client-supplied token
• CVE-2026-44698 — Home Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injection

Markdown version · Browse all CVEs