CVE-2026-100527 OpenClaw before 2026.8.2 Denial of Service via Browser Relay

OpenClaw before 2026.8.2 contains a denial of service vulnerability in the Browser extension relay that allows unauthenticated network sources to exhaust pending-authentication capacity. Attackers can hold every pending slot by maintaining silent WebSocket upgrades, preventing paired extensions...

CVE-2026-100527

Versions of OpenClaw prior to 2026.8.2 are vulnerable to a denial of service (DoS) flaw within the Browser extension relay . This issue allows unauthenticated network sources to exhaust pending-authentication capacity by maintaining silent WebSocket upgrades . By occupying every available pending...

EUVD-2026-87523

OpenClaw before 2026.8.2 contains a denial of service vulnerability in the Browser extension relay that allows unauthenticated network sources to exhaust pending-authentication capacity. Attackers can hold every pending slot by maintaining silent WebSocket upgrades, preventing paired extensions...

CVE-2026-100589: Incorrect Authorization

OpenClaw versions before 2026.7.1 contain a sandbox bypass vulnerability in the browser tool that allows sandboxed sessions to access paired node browser actions despite allowHostControl=false configuration. Attackers with control over sandboxed agent input can select a paired node and perform ho...

PT-2026-99225

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.7.1 Description A sandbox bypass exists in the browser tool that allows sandboxed sessions to access paired node browser actions, even when the allowHostControl variable is set to false. An attacker who controls...

PT-2026-99148

Name of the Vulnerable Software and Affected Versions Cotonti version 1.0.0 Description A reflected cross-site scripting issue exists in the 'message.php' endpoint. The lng parameter is not properly escaped before being displayed in the confirmation dialog, allowing unauthenticated attackers to...

CVE-2026-100521: Improper Neutralization of Input During Web Page Generation

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript escaping. Attackers can craft malicious links with injected JavaScript in the highlight parameter that executes in the browser of any visitor...

CVE-2026-79173

A flaw was found in chromium-browser. A remote attacker could exploit this vulnerability by crafting a malicious HTML page, leading to user interface UI misrepresentation. This misrepresentation allows the attacker to spoof UI elements, potentially deceiving users...

CVE-2026-79151

A flaw was found in Chromium-browser's Safebrowsing component. A remote attacker could exploit this vulnerability by providing a specially crafted file. This could allow the attacker to bypass system access restrictions...

CVE-2026-84348

A flaw was found in the MediaCapture component of chromium-browser. A remote attacker could exploit this vulnerability by enticing a user to visit a specially crafted HTML page. This could potentially lead to the leakage of sensitive information...

CVE-2026-84331

A flaw was found in chromium-browser. This incorrect authorization vulnerability allows a remote attacker, who has already compromised the renderer process, to bypass the web origin policy by using a specially crafted HTML page. This could lead to unauthorized access to data or functionality acro...

CVE-2026-79090

A flaw was found in chromium-browser. Improper privilege management in the Actor component allows a remote attacker to bypass system access restrictions. This can be achieved by leveraging social engineering techniques through a specially crafted HTML page...

CVE-2026-79056

A flaw was found in chromium-browser. A use-after-free vulnerability in the ServiceWorker component allows a remote attacker to potentially execute arbitrary code outside of the sandbox. This can be achieved by enticing a user to visit a specially crafted HTML page...

CVE-2026-79199

A flaw was found in chromium-browser. This incorrect authorization vulnerability allows a remote attacker to bypass system access restrictions. By crafting a malicious HTML page, an attacker can gain unauthorized access within the network component...

CVE-2026-78974

A flaw was found in chromium-browser. This user interface UI misrepresentation vulnerability allows a remote attacker, through social engineering, to bypass system access restrictions by tricking a user into interacting with a specially crafted HTML page. This could lead to unauthorized access to...

CVE-2026-87551

A flaw was found in chromium-browser. This vulnerability involves improper certificate validation within the Cross-Origin Resource Sharing CORS mechanism. A remote attacker, by leveraging social engineering tactics and crafted network traffic, could bypass the web origin policy. This could lead t...

CVE-2026-87601

A flaw was found in V8, the JavaScript engine used in Google Chrome. This race condition vulnerability allows a remote attacker to execute arbitrary code within the browser's sandbox. Exploitation occurs when a user visits a specially crafted HTML page...

CVE-2026-87463

A flaw was found in chromium-browser. This incorrect authorization in the Certificate component allows a remote attacker to potentially spoof the address bar. This could lead to users being misled about the authenticity of a website...

CVE-2026-87627

A flaw was found in chromium-browser. A remote attacker, leveraging social engineering, could exploit an interpretation conflict in Safebrowsing by using a crafted file. This could allow the attacker to bypass system access restrictions...

CVE-2026-87617

A flaw was found in DevTools in Google Chrome. This vulnerability, a 'use after free' error, occurs when a program attempts to use memory after it has been freed, which can lead to unpredictable behavior. A remote attacker could exploit this by leveraging social engineering to entice a user to...