This vulnerability exists in OpenClaw prior to the 2026.3.22 release. The application exposes an unvalidated WebView JavascriptInterface that lets untrusted web content invoke a canvas bridge. By injecting malicious JavaScript, an attacker can execute arbitrary code within the Android application context, which is a classic Remote Code Execution scenario identified by CWE‑940.

OpenClaw is affected by versions older than 2026.3.22. The vendor product is OpenClaw. The affected releases are all releases preceding the 2026.3.22 build. No additional product tiers or plugins are listed; all editions of OpenClaw that use the vulnerable WebView component are susceptible.

The CVSS score of 8.6 indicates a high severity. The EPSS score is not available, and the vulnerability is not present in the CISA KEV catalog, suggesting no publicly known exploits yet. The likely attack vector consists of delivering malicious web pages to the application’s WebView or inserting crafted JavaScript that calls the exposed interface. Successful exploitation would allow attackers to gain full control over the application, potentially compromising all data processed by it.