{"data":{"id":"92c4f547-001d-4b98-8288-cb79be413366","title":"GHSA-cxmw-p77q-wchg: OpenClaw: Arbitrary code execution via unvalidated WebView JavascriptInterface","summary":"OpenClaw's Android Canvas WebView accepted calls to its JavascriptInterface bridge from pages on untrusted origins, letting such pages inject instructions into the app. The affected npm package `openclaw` is any version below 2026.3.22, and the flaw is fixed in 2026.3.22 and later.","solution":"Fixed in 2026.3.22 (commit 8b02ef133275be96d8aac2283100016c8a7f32e5). The fix snapshots page origin in apps/android/app/src/main/java/ai/openclaw/app/ui/CanvasScreen.kt and rejects untrusted bridge calls, with trusted origin and path validation centralized in apps/android/app/src/main/java/ai/openclaw/app/node/CanvasActionTrust.kt.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-cxmw-p77q-wchg","publishedAt":"2026-03-26T19:30:52.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["openclaw@< 2026.3.22 (fixed: 2026.3.22)"],"affectedPackageNames":["openclaw"],"affectedPackageRefs":["npm:openclaw"],"affectedVendors":[],"affectedVendorsRaw":["OpenClaw"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-cxmw-p77q-wchg"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-03-26T19:30:52.000Z","fixReleasedAt":"2026-03-23T11:10:33.721Z","daysToFix":-3,"fixCheckedAt":"2026-10-29T21:39:32.695Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"openclaw","fixedVersion":"2026.3.22","matchedVersion":"2026.3.22","fixReleasedAt":"2026-03-23T11:10:33.721Z","daysToFix":-3,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:39:32.548Z"}]}}