CVE-2026-15193 in openclaw-android
Summary
by MITRE • 07/09/2026
A vulnerability was determined in AidanPark openclaw-android up to 0.4.0. The affected element is an unknown function of the file android/app/src/main/java/com/openclaw/android/JsBridge.kt of the component Android WebView Bridge. This manipulation causes os command injection. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/09/2026
The vulnerability identified in AidanPark openclaw-android version 0.4.0 represents a critical command injection flaw within the Android WebView Bridge component. This security weakness exists in the JsBridge.kt file at android/app/src/main/java/com/openclaw/android/JsBridge.kt where an unknown function processes user input without proper sanitization or validation. The vulnerability stems from insufficient input filtering mechanisms that allow malicious commands to be executed through the WebView bridge interface, creating a direct pathway for arbitrary code execution within the application context.
The technical implementation of this flaw involves the improper handling of JavaScript-to-native function calls through the WebView bridge mechanism. When the vulnerable function processes data passed from JavaScript contexts, it fails to validate or sanitize the input parameters before incorporating them into operating system commands. This design oversight creates a path where attacker-controlled data can be interpreted and executed as shell commands on the underlying operating system. The vulnerability specifically manifests as an os command injection vulnerability that directly violates security principles outlined in CWE-78, which addresses improper neutralization of special elements used in OS commands.
Operationally, this vulnerability presents significant risks despite its local execution requirement. While the attack vector is restricted to local compromise, the implications remain severe given that the exploit has been publicly disclosed and may already be in use by threat actors. The local privilege escalation potential allows an attacker with access to the application to execute arbitrary system commands with the privileges of the application user. This could lead to data exfiltration, persistence mechanisms establishment, or further exploitation of the device's resources. The vulnerability's presence in a mobile application framework like Android WebView Bridge means that successful exploitation could compromise the entire mobile device environment.
The attack surface is particularly concerning due to the nature of WebView bridges which are commonly used for communication between web-based interfaces and native application functionality. This vulnerability affects not only the immediate application but potentially other components that may rely on similar bridging mechanisms. The fact that a pull request exists to address this issue indicates awareness within the development community, yet the delay in acceptance creates an extended window of exposure for users. Organizations deploying this software should immediately implement compensating controls and monitor for exploitation attempts while awaiting official patch deployment.
Security mitigations should focus on immediate input validation and sanitization of all data passed through the WebView bridge interface. The implementation of proper parameter validation, command escaping mechanisms, and input filtering techniques would prevent the injection of malicious commands. Additionally, developers should consider implementing least privilege principles for WebView bridge functions and establish comprehensive logging to detect anomalous command execution patterns. The vulnerability's classification aligns with ATT&CK technique T1059.007 for command and scripting interpreter usage, highlighting the need for robust application-level defenses against such exploitation vectors.