high8.3
CVE-2026-100589
OpenClaw versions before 2026.7.1 contain a sandbox bypass vulnerability in the browser tool that allows sandboxed sessions to access paired node browser actio…
Impact
OpenClaw versions before 2026.7.1 contain a sandbox bypass vulnerability in the browser tool that allows sandboxed sessions to access paired node browser actions despite allowHostControl=false configuration. Attackers with control over sandboxed agent input can select a paired node and perform host browser operations, inspecting or manipulating the connected browser profile and its authenticated state.
Affected products
| Product | Affected versions |
|---|---|
| OpenClaw | before 2026.7.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.