Summary
A high-severity authorization bypass in the OpenClaw browser tool allows sandboxed sessions to invoke browser actions on paired host nodes even when host control is disabled.
An attacker who can influence sandboxed agent input may select an available paired node and inspect or manipulate its browser profile, including authenticated browser state.
Affected context
The issue occurs in OpenClaw deployments that use sandboxed agent sessions together with paired node browser actions. Risk is present when the browser tool permits sandboxed requests to reach a paired node despite an allowHostControl=false policy, allowing operations against a connected browser profile or its authenticated state.
Exploit preconditions
- Attack surface: OpenClaw's browser tool and paired-node browser integration
- Required access: Ability to control or influence input processed by a sandboxed agent
- Trigger point: A sandboxed session requests browser actions and selects an accessible paired node
- Why exploitation is possible: Authorization checks do not consistently enforce the sandbox boundary or the disabled host-control setting before forwarding the action
Why this happens
The vulnerability is caused by an authorization enforcement gap between sandboxed browser-tool requests and paired-node host actions. A security setting intended to prevent host control is not reliably applied to the node-selection and action-dispatch path.
This maps to CWE-863: Incorrect Authorization, where an application fails to verify that a principal is permitted to perform a requested operation on a protected resource. The insecure pattern is treating a sandbox-originated request as authorized for host browser operations without enforcing the applicable trust boundary at each sensitive action.
Potential impact
- An attacker may inspect data available in a connected browser profile
- An attacker could access authenticated web sessions or tokens exposed through browser state
- Unauthorized actions may be performed in websites where the profile is signed in
- Sensitive information could be modified, exfiltrated, or misused
- The paired host or connected services may be affected through browser-based actions
General mitigation guidance
Mitigation generally focuses on enforcing authorization at the final browser-action boundary rather than relying only on session-level settings.
Common defensive patterns include:
- Applying deny-by-default authorization to all sandbox-to-host browser operations
- Treating sandboxed agent input as untrusted and preventing it from selecting privileged nodes
- Rechecking host-control policy, session identity, node identity, and requested action before dispatch
- Separating sandbox browser contexts from authenticated host profiles
- Limiting paired-node capabilities and running browser integrations with the least privilege necessary
- Requiring explicit, auditable user approval for sensitive host browser actions
How teams detect issues like this
Organizations can assess for this class of issue through:
- Static analysis and code review of browser-tool dispatch, node-selection, and authorization paths
- Tests that verify disabled host-control settings remain effective for every browser action
- Policy checks ensuring sandbox-originated requests cannot access host identities or authenticated profiles
- Runtime logging of sandbox-to-node requests, authorization decisions, and sensitive browser operations
- Security regression tests covering alternate action routes, malformed requests, and paired-node selection
- Automated review tools that flag authorization checks performed only at session setup rather than at resource access
