CVE-2026-35643: OpenClaw WebView bridge injection

CISO Take

OpenClaw before 2026.3.22 exposes an unvalidated WebView JavascriptInterface that lets any untrusted web page invoke the application's canvas bridge and execute arbitrary code within the Android app context — full confidentiality, integrity, and availability compromise with no privileges required. At CVSS 8.8 and top-71% EPSS, this sits in the high-exploitability tier; while not yet in CISA KEV and no public exploit exists, the OpenClaw ecosystem has already been abused to deliver credential stealers (AIID #1368), and 396 existing CVEs in the same package signal a historically weak security posture that warrants elevated scrutiny. Upgrade to OpenClaw 2026.3.22 or later immediately by applying commits 630f1479 and 8b02ef13, and audit all WebView configurations in your Android AI agent deployments for exposed JavascriptInterface bindings.

Sources: NVD EPSS GitHub Advisory ATLAS vulncheck.com

What is the risk?

High risk. CVSS 8.8 with network-accessible attack vector, low complexity, and no privileges required makes this trivially exploitable once a user visits a crafted page. Full C/I/A impact within the Android application context. EPSS top-71% indicates elevated exploitation likelihood relative to other published CVEs. Not in KEV and no public exploit confirmed, but the low barrier to exploitation — user visits URL, code runs — combined with OpenClaw's history of ecosystem abuse (396 CVEs in the same package, AIID #1368 credential stealer incident) raises the effective risk for any deployment running Android-based AI agents with external-facing WebView surfaces.

How does the attack unfold?

Initial Access

Attacker crafts a malicious web page invoking OpenClaw's canvas bridge JavascriptInterface, delivered via spearphishing link, poisoned ClawHub skill, or compromised web search result.

AML.T0011.003

Drive-by Execution

The OpenClaw AI agent loads the attacker's URL in the Android embedded WebView; the page executes JavaScript without origin validation against the exposed JavascriptInterface.

AML.T0078

Tool Invocation Abuse

Malicious JavaScript invokes the canvas bridge to issue arbitrary instructions within the Android application context, bypassing all agent permission and origin checks.

AML.T0053

Impact

Attacker achieves full code execution: exfiltrates agent session tokens, stored API keys, and device data, or installs persistence within the AI agent runtime.

AML.T0112

Initial Access

Attacker crafts a malicious web page invoking OpenClaw's canvas bridge JavascriptInterface, delivered via spearphishing link, poisoned ClawHub skill, or compromised web search result.

AML.T0011.003

Drive-by Execution

The OpenClaw AI agent loads the attacker's URL in the Android embedded WebView; the page executes JavaScript without origin validation against the exposed JavascriptInterface.

AML.T0078

Tool Invocation Abuse

Malicious JavaScript invokes the canvas bridge to issue arbitrary instructions within the Android application context, bypassing all agent permission and origin checks.

AML.T0053

Impact

Attacker achieves full code execution: exfiltrates agent session tokens, stored API keys, and device data, or installs persistence within the AI agent runtime.

AML.T0112

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 30% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Unchanged

C High

I High

A High

What should I do?

5 steps

Patch immediately: upgrade to OpenClaw ≥ 2026.3.22 or cherry-pick commits 630f1479c44f and 8b02ef133275.
Audit all WebView configurations in Android AI agent code — ensure addJavascriptInterface is never bound to contexts that render unvalidated external URLs.
Enforce WebView allowlisting: restrict setJavaScriptEnabled and JavascriptInterface bindings to verified internal or domain-pinned origins only.
Detection: monitor Android logcat and MDM telemetry for anomalous canvas bridge API calls originating from non-whitelisted WebView origins.
If immediate patching is blocked, disable external URL rendering in the agent's WebView as a temporary compensating control until the fix can be deployed.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Agent Plugin AML.T0011.003 - Malicious Link AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0078 - Drive-by Compromise AML.T0112 - Machine Compromise

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.9.4 - Technical security measures for AI systems

NIST AI RMF

MANAGE 2.2 - Mechanisms to sustain treatment of identified AI risks

OWASP LLM Top 10

LLM05 - Improper Output Handling LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-35643?

OpenClaw before 2026.3.22 exposes an unvalidated WebView JavascriptInterface that lets any untrusted web page invoke the application's canvas bridge and execute arbitrary code within the Android app context — full confidentiality, integrity, and availability compromise with no privileges required. At CVSS 8.8 and top-71% EPSS, this sits in the high-exploitability tier; while not yet in CISA KEV and no public exploit exists, the OpenClaw ecosystem has already been abused to deliver credential stealers (AIID #1368), and 396 existing CVEs in the same package signal a historically weak security posture that warrants elevated scrutiny. Upgrade to OpenClaw 2026.3.22 or later immediately by applying commits 630f1479 and 8b02ef13, and audit all WebView configurations in your Android AI agent deployments for exposed JavascriptInterface bindings.

Is CVE-2026-35643 actively exploited?

No confirmed active exploitation of CVE-2026-35643 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35643?

1. Patch immediately: upgrade to OpenClaw ≥ 2026.3.22 or cherry-pick commits 630f1479c44f and 8b02ef133275. 2. Audit all WebView configurations in Android AI agent code — ensure addJavascriptInterface is never bound to contexts that render unvalidated external URLs. 3. Enforce WebView allowlisting: restrict setJavaScriptEnabled and JavascriptInterface bindings to verified internal or domain-pinned origins only. 4. Detection: monitor Android logcat and MDM telemetry for anomalous canvas bridge API calls originating from non-whitelisted WebView origins. 5. If immediate patching is blocked, disable external URL rendering in the agent's WebView as a temporary compensating control until the fix can be deployed.

What systems are affected by CVE-2026-35643?

This vulnerability affects the following AI/ML architecture patterns: mobile AI agents, agent frameworks, AI agent tools.

What is the CVSS score for CVE-2026-35643?

CVE-2026-35643 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.37%.

What is the AI security impact?

Affected AI Architectures

mobile AI agentsagent frameworksAI agent tools

MITRE ATLAS Techniques

AML.T0011.003 Malicious Link

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0078 Drive-by Compromise

AML.T0112 Machine Compromise

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.9.4

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM05, LLM06

What are the technical details?

Original Advisory

OpenClaw before 2026.3.22 contains an unvalidated WebView JavascriptInterface vulnerability allowing attackers to inject arbitrary instructions. Untrusted pages can invoke the canvas bridge to execute malicious code within the Android application context.

Exploitation Scenario

An adversary crafts a malicious web page containing JavaScript that directly invokes OpenClaw's canvas bridge JavascriptInterface. The URL is distributed via spearphishing, a poisoned ClawHub skill package, or a compromised result in a web search the AI agent executes as part of a research subtask. When the OpenClaw agent loads the page in its embedded Android WebView — for example, during autonomous web browsing — the malicious script runs without origin validation and issues arbitrary instructions within the Android application context. The attacker then exfiltrates session tokens, API keys stored by the agent, device contacts, or pivots to additional Android permissions already granted to the OpenClaw application, replicating the credential theft pattern observed in AIID #1368.

Weaknesses (CWE)

CWE-940 Improper Verification of Source of a Communication Channel

CWE-940 — Improper Verification of Source of a Communication Channel: The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.

[Architecture and Design] Use a mechanism that can validate the identity of the source, such as a certificate, and validate the integrity of data to ensure that it cannot be modified in transit using an Adversary-in-the-Middle (AITM) attack. When designing functionality of actions in the URL scheme, consider whether the action should be accessible to all mobile applications, or if an allowlist of applications to interface with is appropriate.

Source: MITRE CWE corpus.