CVE-2026-35643

CVE-2026-35643 is an unvalidated WebView JavascriptInterface vulnerability in OpenClaw versions prior to 2026.3.22 that enables attackers to inject arbitrary instructions and execute malicious code within the Android application context by exploiting the canvas bridge through untrusted web pages. This vulnerability poses a significant risk to any Android application using the affected OpenClaw library versions. The vulnerability carries a CVSS score of 8.8 (HIGH severity) with a network-based attack vector requiring only user interaction, making it relatively easy to exploit. The attack requires no special privileges and can result in high impact across confidentiality, integrity, and availability of the affected system, allowing attackers to potentially compromise sensitive user data and application functionality. Exploitation status indicates this is not currently being actively exploited in the wild, with no known exploit code publicly available and minimal community attention to date. The FAUCET Risk Score of 52.0 and EPSS score of 0.000420 suggest lower immediate exploitation probability, though organizations should still prioritize updating to version 2026.3.22 or later to mitigate the underlying vulnerability before threat actors develop and distribute exploit code.