A security bypass vulnerability in the OpenClaw library allows authenticated attackers to modify persistent browser profiles, posing a significant risk to configuration integrity.

The vulnerability exists in the node.invoke(browser.proxy) function, which fails to properly enforce authorization checks. This flaw allows an authenticated attacker to bypass the browser.request persistent profile-mutation guard and manipulate sensitive browser configurations.

Successful exploitation of this flaw could allow an attacker to alter browser security settings or persistence mechanisms, potentially leading to unauthorized data access or session hijacking. With a CVSS score of 8.1, the vulnerability represents a high risk to organizational security, as it compromises the integrity of the browser environment and undermines the protective measures designed to prevent persistent configuration changes.

Immediate Action: Update the OpenClaw package to version 2026.4.8 or later to incorporate the necessary authorization guards.

Proactive Monitoring: Review application logs for unusual calls to the node.invoke or browser.proxy functions that deviate from standard user activity patterns.

Compensating Controls: Implement strict access control policies to limit the users who can invoke sensitive library functions, and ensure that any browser-based application is operating within a hardened containerized environment.

Public Exploit Available: Unknown

The vulnerability in OpenClaw is a serious authorization flaw that requires immediate attention. Given the high CVSS score and the potential for persistent configuration manipulation, administrators should prioritize updating to version 2026.4.8 immediately to eliminate this attack surface and protect the integrity of deployed browser environments.