Vulnerability · Published Jul 9, 2026 · Assigned by VulDB

CVE-2026-15193AidanPark openclaw-android Android WebView Bridge JsBridge.kt os command injection

Medium 5.3

In plain English

A medium-severity OS command injection in openclaw-android from AidanPark. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)1.1%top 34.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in AidanPark openclaw-android up to 0.4.0. The affected element is an unknown function of the file android/app/src/main/java/com/openclaw/android/JsBridge.kt of the component Android WebView Bridge. This manipulation causes os command injection. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.

Affected products (as reported)

Vendor	Product	Versions
AidanPark	openclaw-android	0.10.20.30.4.0

Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-377120 | AidanPark openclaw-android Android WebView Bridge JsBridge.kt os command injection vdb-entry
VDB-377120 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-15193 | CVE Analysis and Report third-party-advisory
Submit #851623 | AidanPark openclaw-android 0.4.0 Arbitrary Command Execution / Policy Bypass third-party-advisory
https://github.com/AidanPark/openclaw-android/issues/136 exploit, issue-tracking
https://github.com/AidanPark/openclaw-android/pull/137 issue-tracking, patch
https://github.com/AidanPark/openclaw-android/ product