CVE-2026-53812: OpenClaw's browser act interactions could bypass private-network navigation checks

The browser control feature runs an SSRF check when it navigates to a URL, and rejects private-network and loopback targets. That check ran at the start. A page the browser was allowed to visit could redirect the tab, or navigate it, as a result of a UI action sent through Playwright act, such as a click. The destination of that second navigation was not checked.

The attacker needs two things: an authenticated browser-control caller with browser evaluation capability, and a page the attacker controls that sends the tab to a private target when someone interacts with it. Once the tab lands on, say, an internal admin panel or a cloud metadata address, a later browser evaluation reads the page content. That means data from services that are only reachable from the OpenClaw host's network.

The advisory says this does not grant access to OpenClaw without authentication. It bypasses the private-network guard for one action path. The two scoring systems disagree on severity: 4.9 in CVSS 4.0 and 7.7 in 3.1. The 3.1 score reflects a changed scope, because the read crosses into other systems.

The npm package openclaw before 2026.5.18, where browser control is enabled and an authenticated caller can interact with an attacker-controlled page that navigates the tab to a private-network target through a UI action.

npm ls openclaw

Use npm ls -g openclaw for a global install. Anything below 2026.5.18 is affected.

Upgrade to [email protected] or later, the first stable patched version:

npm install [email protected]

Before upgrading, the advisory says to restrict browser-control access to trusted operators and to avoid using browser control on untrusted pages in environments that have sensitive private web services.

Review browser control logs for act interactions followed by tab URLs on private ranges, loopback or link-local addresses such as the cloud metadata IP, and for evaluation calls right after. Check access logs of internal services for requests from the OpenClaw host that you cannot explain. The advisory gives no log line. Beam records agent actions on the machine, which may help trace what an agent did in the browser session.

Summary

OpenClaw's browser control SSRF checks blocked direct navigation to private or loopback URLs, but some Playwright act interactions could trigger navigation after the initial check. A later browser evaluation could then read from the page reached by that action-triggered navigation.

This issue is specific to browser control actions and private-network navigation policy. Browser evaluation remains an intentional trusted-operator feature when it is used on pages that policy allowed the browser to visit.

Affected configurations

This affects deployments where browser control is enabled and an authenticated browser-control caller can interact with an attacker-controlled page that redirects or navigates the tab to a private-network target through a UI action.

Impact

If the browser reached a private page through an unchecked action-triggered navigation, a caller with browser evaluation capability could read page content that direct navigation policy would have blocked.

The issue does not grant access to OpenClaw without authentication. It bypasses the private-network navigation guard for a specific browser action path.

Patched Versions

The first stable patched version is 2026.5.18.

Mitigations

Upgrade to [email protected] or later. Before upgrading, restrict browser-control access to trusted operators and avoid using browser control on untrusted pages in environments with sensitive private web services.