OpenClaw before version 2026.4.8 contains a bypass that allows an attacker to mutate persistent browser profiles by invoking node.invoke(browser.proxy). This flaw permits the tampering of browser configurations, potentially enabling the attacker to install malicious extensions, alter privacy settings, or redirect traffic. The primary effect is the unauthorized modification of critical browser settings that an administrator would normally protect, thereby compromising system integrity and confidentiality.

The vulnerability affects all installations of OpenClaw running a version older than 2026.4.8. Users of the OpenClaw product on node.js platforms are impacted; the CVE data does not specify sub‑versions or operating systems beyond the general OpenClaw product identification.

The CVSS score of 7.6 indicates a high severity. EPSS data is not available, so the exploitation probability cannot be quantified, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is through local or remote code execution that grants access to the node.invoke API; if an attacker can run code in the OpenClaw context, the bypass can be exercised to alter persistent profiles. Because the flaw permits modification of core browser configuration, a successful exploit could lead to persistent privilege escalation or lateral movement within the environment.