OpenClaw WebView JavascriptInterface Vulnerability Allowing Arbitrary Code Execution

A vulnerability exists in OpenClaw versions prior to 2026.3.22, where the WebView JavascriptInterface is not properly validated. This flaw allows untrusted web pages to inject and execute arbitrary instructions through the canvas bridge, within the context of the Android application.

Impact

Exploitation of this vulnerability allows for arbitrary code execution within the OpenClaw Android application.

Reproduction

To reproduce this vulnerability, load an untrusted web page into the OpenClaw WebView. The page can then invoke the canvas bridge via the JavascriptInterface, executing injected code within the app.

Remediation

Users can update to OpenClaw version 2026.3.22 or later to address this vulnerability.