CVE-2026-32046: OpenClaw sandbox bypass enables

CISO Take

OpenClaw versions prior to 2026.2.21 ship with OS-level sandbox protections disabled in their embedded Chromium container, meaning any renderer-side exploit achieves host code execution without the additional step of a sandbox escape — a significant severity amplifier beyond the CVSS 5.3 score. The package sits at the 80th EPSS percentile, carries 396 CVEs on record, and has a documented precedent in AIID #1368 where malicious OpenClaw skills delivered the AMOS credential stealer via its ClawHub ecosystem. There is no public exploit or scanner template today and the CVE is not in CISA KEV, which limits immediate mass-exploitation risk. If your environment runs OpenClaw, patch to 2026.2.21 immediately; if patching is not feasible, isolate OpenClaw execution inside a dedicated VM with no host-mount access and audit installed skills for unverified or unsigned sources.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

CVSS 5.3 (Medium) with a local attack vector understates the real risk in agentic deployments where OpenClaw processes untrusted web content on behalf of users. The disabled OS-level sandbox collapses the typical two-step exploit chain — renderer exploit plus sandbox escape — into a single step, lowering attacker cost substantially. EPSS at the 80th percentile indicates above-average exploitation likelihood relative to the published CVE corpus. The 396-CVE history of this package and documented adversarial abuse of its skills ecosystem (AIID #1368) signal sustained attacker interest. Organizations running OpenClaw with broad filesystem or network agent permissions face a chained risk where a single malicious skill or phishing-delivered page can pivot directly to the host.

How does the attack unfold?

Skill Delivery

Attacker publishes a malicious OpenClaw skill to ClawHub containing attacker-controlled HTML/JavaScript designed to exploit the embedded Chromium renderer.

AML.T0011.002

Renderer Exploitation

Victim invokes the poisoned skill; the Chromium renderer processes attacker content and a renderer-side vulnerability (e.g., V8 type confusion) is triggered.

AML.T0049

Sandbox Bypass

With OS-level sandbox protections disabled (CWE-1188), the renderer exploit escalates directly to host-process execution without requiring a separate sandbox escape primitive.

AML.T0105

Host Compromise

Attacker achieves arbitrary code execution on the host, enabling credential harvesting, exfiltration of AI agent API keys and configuration, or persistent backdoor deployment.

AML.T0112.000

Skill Delivery

Attacker publishes a malicious OpenClaw skill to ClawHub containing attacker-controlled HTML/JavaScript designed to exploit the embedded Chromium renderer.

AML.T0011.002

Renderer Exploitation

Victim invokes the poisoned skill; the Chromium renderer processes attacker content and a renderer-side vulnerability (e.g., V8 type confusion) is triggered.

AML.T0049

Sandbox Bypass

With OS-level sandbox protections disabled (CWE-1188), the renderer exploit escalates directly to host-process execution without requiring a separate sandbox escape primitive.

AML.T0105

Host Compromise

Attacker achieves arbitrary code execution on the host, enabling credential harvesting, exfiltration of AI agent API keys and configuration, or persistent backdoor deployment.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 21% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Local

AC Low

PR Low

UI None

S Unchanged

C Low

I Low

A Low

What should I do?

5 steps

Patch: Upgrade to OpenClaw ≥ 2026.2.21, which restores OS-level Chromium sandbox protections.
Verify config: Confirm the running instance does not pass --no-sandbox or equivalent flags to the Chromium child process; check launch arguments and wrapper scripts.
Isolate: Until patched, run OpenClaw inside a dedicated rootless container or VM with no bind-mounts to sensitive host paths.
Skills audit: Review all installed skills against the official registry; reject unsigned, unverified, or community-only skills (see AIID #1368 for the threat model).
Detect: Monitor for unexpected child-process spawns from the OpenClaw Chromium process — specifically sh, bash, cmd.exe, powershell, curl, or wget — as high-fidelity IOCs for renderer exploitation.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Supply Chain Agent Plugin AML.T0011.002 - Poisoned AI Agent Tool AML.T0097 - Virtualization/Sandbox Evasion AML.T0105 - Escape to Host AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system operational controls

NIST AI RMF

MANAGE 2.2 - Mechanisms are in place and applied to sustain the value of deployed AI systems

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32046?

OpenClaw versions prior to 2026.2.21 ship with OS-level sandbox protections disabled in their embedded Chromium container, meaning any renderer-side exploit achieves host code execution without the additional step of a sandbox escape — a significant severity amplifier beyond the CVSS 5.3 score. The package sits at the 80th EPSS percentile, carries 396 CVEs on record, and has a documented precedent in AIID #1368 where malicious OpenClaw skills delivered the AMOS credential stealer via its ClawHub ecosystem. There is no public exploit or scanner template today and the CVE is not in CISA KEV, which limits immediate mass-exploitation risk. If your environment runs OpenClaw, patch to 2026.2.21 immediately; if patching is not feasible, isolate OpenClaw execution inside a dedicated VM with no host-mount access and audit installed skills for unverified or unsigned sources.

Is CVE-2026-32046 actively exploited?

No confirmed active exploitation of CVE-2026-32046 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32046?

1. Patch: Upgrade to OpenClaw ≥ 2026.2.21, which restores OS-level Chromium sandbox protections. 2. Verify config: Confirm the running instance does not pass `--no-sandbox` or equivalent flags to the Chromium child process; check launch arguments and wrapper scripts. 3. Isolate: Until patched, run OpenClaw inside a dedicated rootless container or VM with no bind-mounts to sensitive host paths. 4. Skills audit: Review all installed skills against the official registry; reject unsigned, unverified, or community-only skills (see AIID #1368 for the threat model). 5. Detect: Monitor for unexpected child-process spawns from the OpenClaw Chromium process — specifically `sh`, `bash`, `cmd.exe`, `powershell`, `curl`, or `wget` — as high-fidelity IOCs for renderer exploitation.

What systems are affected by CVE-2026-32046?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, browser-integrated AI agents, desktop AI agents, agentic RPA workflows.

What is the CVSS score for CVE-2026-32046?

CVE-2026-32046 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.29%.

What is the AI security impact?

Affected AI Architectures

agent frameworksbrowser-integrated AI agentsdesktop AI agentsagentic RPA workflows

MITRE ATLAS Techniques

AML.T0011.002 Poisoned AI Agent Tool

AML.T0097 Virtualization/Sandbox Evasion

AML.T0105 Escape to Host

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.21 contain an improper sandbox configuration vulnerability that allows attackers to execute arbitrary code by exploiting renderer-side vulnerabilities without requiring a sandbox escape. Attackers can leverage the disabled OS-level sandbox protections in the Chromium browser container to achieve code execution on the host system.

Exploitation Scenario

An adversary publishes a malicious OpenClaw skill to ClawHub containing attacker-controlled HTML and JavaScript targeting the embedded Chromium renderer. When a victim invokes the skill, the renderer processes the payload and a V8-level exploit achieves code execution. Because OS-level sandbox protections are disabled (CWE-1188), this renderer compromise escalates directly to the host without requiring a sandbox escape step. The attacker drops a reverse shell or credential-harvesting payload — consistent with AMOS stealer delivery documented in AIID #1368 — and from the host can exfiltrate AI agent configuration files, stored API keys, model weights, or connected database credentials, extending the breach well beyond the OpenClaw process boundary.

Weaknesses (CWE)

CWE-1188 Initialization of a Resource with an Insecure Default

CWE-1188 — Initialization of a Resource with an Insecure Default: The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Source: MITRE CWE corpus.