Unvalidated WebView JavascriptInterface Vulnerability in OpenClaw by OpenClaw

CVE-2026-35643

What is CVE-2026-35643?

OpenClaw versions prior to 2026.3.22 contain a vulnerability related to the unvalidated WebView JavascriptInterface, which can be exploited by attackers to inject malicious instructions into the application. This issue allows untrusted web pages to invoke the canvas bridge, executing arbitrary code within the Android app context. Such vulnerabilities can lead to significant security risks, including unauthorized access and control over the application, potentially compromising user data and application integrity.

References