An unvalidated WebView interface in OpenClaw allows remote attackers to execute arbitrary code within the application context, posing a severe risk to mobile device security.

This vulnerability is caused by improper verification of the WebView JavascriptInterface, which allows unauthenticated remote attackers to inject and execute arbitrary instructions by leveraging the canvas bridge.

Successful exploitation allows an attacker to execute malicious code with the full privileges of the OpenClaw application, potentially leading to unauthorized data access, credential theft, or the compromise of sensitive user information. With a CVSS score of 8.8, this vulnerability is classified as High, reflecting the significant risk of remote code execution and the potential for broad impact on the user base.

Immediate Action: Update the OpenClaw package to version 2026.3.22 or later immediately to incorporate the necessary validation logic.

Proactive Monitoring: Monitor application logs for unusual WebView activity or unexpected calls to the JavascriptInterface and investigate any unauthorized attempts to access the canvas bridge.

Compensating Controls: Implement strict Content Security Policy (CSP) headers if the application architecture allows, and ensure that WebView configurations disable JavaScript if it is not strictly required for the intended functionality.

Public Exploit Available: No

Given the severity of this remote code execution vulnerability, organizations using OpenClaw must prioritize the update to version 2026.3.22. Failure to patch allows attackers to potentially seize control of the application context, making immediate remediation essential to maintain the integrity and security of the affected mobile environment.