OpenClaw patches browser flaw that bypassed blocked URLs

OpenClaw has published a security advisory for a flaw in its browser automation code that allowed connections to network destinations its own policy should have refused. The advisory, GHSA-3x84-qq85-fj65, was published on 21 October 2026 and carries the identifier CVE-2026-62197. It affects the openclaw package on npm, and the first stable patched version is 2026.6.6.

The problem sits in what the advisory calls browser CDP discovery. CDP is the Chrome DevTools Protocol, the interface that lets software drive and inspect a browser, usually over a WebSocket connection. According to the advisory, that discovery step "could accept blocked WebSocket URLs". In affected versions, the advisory says, "a lower-trust caller or configured input path could reach network destinations that should have been blocked by OpenClaw policy".

That matters for agent deployments because URL blocking is one of the few controls standing between an automated agent and the rest of a network. If a destination on a blocklist can still be dialled through the browser debugging channel, the policy that operators configured is not doing the job they expect.

OpenClaw is cautious about how far the issue goes. The advisory says the impact depends on whether the affected feature is enabled and reachable, and on "the operator's configuration and whether lower-trust input can reach that path". It gives no exploitation details, no severity score in the text supplied, and no indication that the flaw has been used against real deployments.

The advisory also draws a boundary around its own scope. It says it "does not change OpenClaw's trusted-operator model", under which authenticated Gateway operators, installed plugins and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox or authentication boundary is crossed. In other words, the company is treating this as a failure of one specific filter rather than a break in its overall trust design.

For operators who cannot upgrade immediately, OpenClaw recommends restricting the affected feature to trusted operators or switching it off when it is not needed. As broader hardening, the advisory tells users to keep channel and tool allowlists narrow and to avoid sharing a single Gateway between users who do not trust each other. That last point is a recurring theme in agent security: a shared gateway turns one user's permitted action into another user's potential route in.

Users running the npm openclaw package should check their installed version against 2026.6.6 and upgrade where a patched release is listed.