A critical authentication bypass vulnerability in OpenClaw allows local attackers to hijack browser sessions and exfiltrate sensitive data, posing a significant risk to user privacy and session integrity.

The sandbox browser bridge server fails to perform gateway authentication, enabling local, unauthenticated attackers to interact with browser control endpoints. This flaw allows unauthorized parties to enumerate tabs, execute arbitrary JavaScript, and access authenticated session cookies.

The vulnerability carries a CVSS score of 7.7, representing a high risk to organizational security. Successful exploitation results in the compromise of sensitive session data and the potential for account takeover, as attackers can exfiltrate cookies from authenticated browser contexts. This could lead to unauthorized access to internal applications and the exposure of proprietary or confidential information.

Immediate Action: Update the OpenClaw package to version 2026.2.14 or later to apply the necessary authentication checks within the bridge server.

Proactive Monitoring: Review system logs for unauthorized access attempts directed at the browser bridge server and monitor for abnormal WebSocket traffic patterns.

Compensating Controls: Restrict local user permissions to prevent unauthorized processes from interacting with the sandbox environment and ensure that sensitive browser sessions are cleared when not in use.

Public Exploit Available: Unknown.

The risk posed by CVE-2026-28468 is significant due to the nature of the data accessible through the browser bridge. Administrators should prioritize the deployment of the 2026.2.14 update across all environments using OpenClaw. Failure to patch allows local attackers to effectively bypass security controls and gain unauthorized access to active user sessions.