EUVD-2026-39104

chrome-devtools-mcp: validatePath does not canonicalize symlinks before enforcing roots...

PT-2026-25418

Summary A path-confinement bypass in browser output handling allowed writes outside intended roots in openclaw versions up to and including 2026.3.1. The fix unifies root-bound, file-descriptor-verified write semantics and canonical path-boundary validation across browser output and related...