CVE-2026-15193: command injection — MEDIUM

CISO Take

OpenClaw for Android exposes an unsanitized function in its WebView-to-native JsBridge (JsBridge.kt) that lets attacker-controlled input trigger OS command execution on the device. A CISO should weigh this carefully: CVSS is only medium (5.3, AV:L/AC:L/PR:L/UI:N) because CVSS models it as requiring local access, but a WebView JS bridge is typically reachable from whatever content the app renders — if OpenClaw's agent browses or displays untrusted web content as part of its normal operation, that content becomes the practical delivery mechanism, low privileges and no user interaction are needed once reached, and full read/write/execute impact (C:L/I:L/A:L across the board) follows. There is no EPSS score, no CISA KEV listing, and no public scanner template, but the exploit is already publicly disclosed and the vendor fix (PR #137) has not yet been merged, so this is an unpatched, disclosed weakness with no official remediation timeline. Track the upstream PR and, until it merges, audit or disable the exposed JsBridge interface and treat any content loaded in the app's WebView as untrusted input to that bridge.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Medium CVSS (5.3) but elevated practical urgency: the vulnerability is publicly disclosed, unpatched (fix PR open but not accepted), and affects an AI agent client that by design consumes and acts on external/web content. The 'local' attack vector in the CVSS vector reflects that the trigger path runs through the app's own WebView rather than the network directly, but this is a common pattern where a malicious webpage or agent-retrieved content is the actual delivery mechanism, effectively lowering the real-world bar to exploitation. No EPSS data, KEV listing, or Nuclei template exists, so there is no evidence of mass automated exploitation yet, but public disclosure without a merged fix means the window of exposure is open-ended and any device running vulnerable OpenClaw Android builds (≤0.4.0) is exposed.

How does the attack unfold?

Content delivery

Attacker delivers a malicious webpage or content payload designed to be rendered by the OpenClaw Android app's WebView.

AML.T0078

Bridge invocation

Untrusted JavaScript in the rendered content calls into the exposed JsBridge interface in JsBridge.kt.

Command injection

JsBridge passes the attacker-controlled input unsanitized into an OS command execution path, triggering command injection.

AML.T0050

Device compromise

Arbitrary commands execute with the app's OS privileges, enabling data theft, persistence, or lateral movement on the device.

AML.T0112.000

Content delivery

Attacker delivers a malicious webpage or content payload designed to be rendered by the OpenClaw Android app's WebView.

AML.T0078

Bridge invocation

Untrusted JavaScript in the rendered content calls into the exposed JsBridge interface in JsBridge.kt.

Command injection

JsBridge passes the attacker-controlled input unsanitized into an OS command execution path, triggering command injection.

AML.T0050

Device compromise

Arbitrary commands execute with the app's OS privileges, enabling data theft, persistence, or lateral movement on the device.

AML.T0112.000

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

1.1%

chance of exploitation in 30 days

Higher than 63% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Local

AC Low

PR Low

UI None

S Unchanged

C Low

I Low

A Low

What should I do?

1 step

Track and expedite merge of the upstream fix at github.com/AidanPark/openclaw-android/pull/137; there is no released patched version yet. Until merged: audit JsBridge.kt for any method exposed via addJavascriptInterface (or equivalent) that flows into Runtime.exec/ProcessBuilder/shell invocation, and add strict input validation/allowlisting on any string reaching command execution. Restrict what content the app's WebView is allowed to load (disable JavaScript for untrusted origins, use setAllowFileAccess(false), origin allowlisting) to reduce the practical delivery surface. Where feasible, disable or gate the JsBridge interface behind a build flag until the fix lands. Detection: monitor for unexpected child process spawns from the OpenClaw Android app process, and review issue #136 for IOC/disclosure details as they emerge.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Agent Plugin AML.T0050 - Command and Scripting Interpreter AML.T0078 - Drive-by Compromise AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

NIST AI RMF

MANAGE-4.1 - Third-party/component risk management

OWASP LLM Top 10

LLM07 - Insecure Plugin Design LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-15193?

OpenClaw for Android exposes an unsanitized function in its WebView-to-native JsBridge (JsBridge.kt) that lets attacker-controlled input trigger OS command execution on the device. A CISO should weigh this carefully: CVSS is only medium (5.3, AV:L/AC:L/PR:L/UI:N) because CVSS models it as requiring local access, but a WebView JS bridge is typically reachable from whatever content the app renders — if OpenClaw's agent browses or displays untrusted web content as part of its normal operation, that content becomes the practical delivery mechanism, low privileges and no user interaction are needed once reached, and full read/write/execute impact (C:L/I:L/A:L across the board) follows. There is no EPSS score, no CISA KEV listing, and no public scanner template, but the exploit is already publicly disclosed and the vendor fix (PR #137) has not yet been merged, so this is an unpatched, disclosed weakness with no official remediation timeline. Track the upstream PR and, until it merges, audit or disable the exposed JsBridge interface and treat any content loaded in the app's WebView as untrusted input to that bridge.

Is CVE-2026-15193 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-15193, increasing the risk of exploitation.

How to fix CVE-2026-15193?

Track and expedite merge of the upstream fix at github.com/AidanPark/openclaw-android/pull/137; there is no released patched version yet. Until merged: audit `JsBridge.kt` for any method exposed via `addJavascriptInterface` (or equivalent) that flows into `Runtime.exec`/`ProcessBuilder`/shell invocation, and add strict input validation/allowlisting on any string reaching command execution. Restrict what content the app's WebView is allowed to load (disable JavaScript for untrusted origins, use `setAllowFileAccess(false)`, origin allowlisting) to reduce the practical delivery surface. Where feasible, disable or gate the JsBridge interface behind a build flag until the fix lands. Detection: monitor for unexpected child process spawns from the OpenClaw Android app process, and review issue #136 for IOC/disclosure details as they emerge.

What systems are affected by CVE-2026-15193?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, mobile AI agent clients.

What is the CVSS score for CVE-2026-15193?

CVE-2026-15193 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 1.08%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmobile AI agent clients

MITRE ATLAS Techniques

AML.T0050 Command and Scripting Interpreter

AML.T0078 Drive-by Compromise

AML.T0112.000 Local AI Agent

Compliance Controls Affected

NIST AI RMF: MANAGE-4.1

OWASP LLM Top 10: LLM07, LLM08

What are the technical details?

Original Advisory

A vulnerability was determined in AidanPark openclaw-android up to 0.4.0. The affected element is an unknown function of the file android/app/src/main/java/com/openclaw/android/JsBridge.kt of the component Android WebView Bridge. This manipulation causes os command injection. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.

Exploitation Scenario

An attacker crafts a malicious webpage or content payload designed to be rendered or retrieved by the OpenClaw Android agent's WebView (e.g., during autonomous browsing, a shared link, or agent-fetched content). Untrusted JavaScript in that content calls into the exposed JsBridge interface. JsBridge passes the attacker-controlled string into an OS command execution path in `JsBridge.kt` without sanitization, causing arbitrary command execution with the app's OS-level privileges — enabling data theft, credential harvesting, persistence, or further lateral movement on the compromised device.

Weaknesses (CWE)

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') Primary CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Primary CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-77 — Improper Neutralization of Special Elements used in a Command ('Command Injection'): The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Implementation] If possible, ensure that all external commands called from the program are statically created.

Source: MITRE CWE corpus.