EUVD-2026-87381
GHSA-2vm8-mpc3-ch96
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain tool-invocation access to agent
-
DeliveryCraft malicious audio command array
-
ExploitInvoke googlemeet.chrome bypassing exec approval
-
ExecutionExecute attacker processes on paired node
-
ImpactSteal credentials and browser profiles
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires all of the following simultaneously: the Google Meet plugin must be enabled, a paired Chrome node must be present, and googlemeet.chrome must appear in the allowed node commands list. Additionally, the attacker needs a tool-enabled agent authorized to invoke that command (PR:L). The core flaw is that googlemeet.chrome accepts caller-supplied audio command arrays and executes them on the paired node without routing through the normal system.run exec-approval flow. Limiting factors: the feature combination is not a universal default, and access to invoke agent tool commands is required. Removing googlemeet.chrome from allowed node commands or disabling the Google Meet plugin fully mitigates the issue, as does upgrading to 2026.7.1. |
| Impact | The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) reflects genuine high technical impact - full confidentiality, integrity, and availability loss on the paired node via OS command execution (CWE-78). However, the raw score understates the deployment gating: exploitation requires three simultaneous non-default preconditions (Google Meet plugin enabled, a paired Chrome node, and googlemeet.chrome present in the allowed node commands) plus a tool-enabled agent already authorized to invoke the command (PR:L). No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so this is no public exploit identified at time of analysis. This is a real, patchable RCE priority for the specific subset of OpenClaw operators running the vulnerable feature combination, but it is not a broad mass-exploitation risk for typical or default deployments. The PR:L rating aligns with the description's requirement that an already tool-enabled agent invoke the command, i.e. authenticated/authorized access to the agent runtime is a prerequisite. |
| Exploit ScenarioDerived | In an OpenClaw deployment with the Google Meet plugin active and a paired Chrome node, a tool-enabled agent (or an attacker who can influence that agent's tool calls, e.g. via prompt injection) invokes the googlemeet.chrome command with a crafted audio command array. Because that command bypasses the normal system.run exec-approval flow, the supplied processes execute directly on the paired node, giving the attacker access to files, credentials, and browser profiles. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 26, 2026
OS command execution on paired Chrome nodes is possible in OpenClaw 2026.5.1 through 2026.7.0 because the googlemeet.chrome node command accepts caller-supplied audio command arrays and runs them on the paired node without passing through the normal system.run exec-approval flow. An authenticated, tool-enabled agent (CVSS vector PR:L) that is permitted to invoke googlemeet.chrome - in a deployment where the Google Meet plugin is enabled, a Chrome node is paired, and googlemeet.chrome is on the allowed node commands list - can launch attacker-chosen processes on that node, with full confidentiality, integrity, and availability impact on the paired node (assessed CVSS 3.1 8.6; vendor CVSS 4.0 base 8.7). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the flaw is fixed in 2026.7.1, and removing googlemeet.chrome from allowed node commands or disabling the Google Meet plugin fully mitigates it.
RemediationAI
Upgrade OpenClaw to 2026.7.1 or later, which is the vendor-released fix for this issue; this is the only change that restores the exec-approval flow for googlemeet.chrome. If immediate upgrade is not possible, apply either documented workaround: remove googlemeet.chrome from the allowed node commands list (this disables the affected Google Meet audio-command capability on nodes but may break Meet-driven Chrome audio automation for legitimate users), or disable the Google Meet plugin entirely (this removes the attack surface but disables all Meet integration functionality). Both workarounds fully mitigate the issue per the advisory. Additionally, since the CVSS vector is PR:L, restrict which agents and accounts are permitted to invoke node tool commands and review paired Chrome nodes for unexpected command allow-list entries; this reduces reachability but does not by itself close the bypass, so it should be treated as defense in depth rather than a substitute for upgrading. Consult the GitHub advisory GHSA-224w-vfr9-h35c (https://github.com/openclaw/openclaw/security/advisories/GHSA-224w-vfr9-h35c) and the VulnCheck advisory (https://www.vulncheck.com/advisories/openclaw-2026.5.1-before-2026.7.1-remote-code-execution-via-googlemeet-chrome) for vendor-confirmed guidance and any updated fixed versions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-100599 is a CWE-78 OS command injection arising from a missing authorization/approval gate rather than from string concatenation in a shell call. OpenClaw routes node-executed commands through an exec-approval flow (system.run) that is meant to vet commands before they run on a paired node. The googlemeet.chrome command - part of the Google Meet plugin's Chrome/audio handling - instead takes a caller-supplied array of audio commands and dispatches them to the paired node directly, bypassing that approval path. Because the array is attacker-influenced and is executed on the node's OS, the effect is arbitrary process execution on the paired Chrome node. The affected component is identified by CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*, covering OpenClaw 2026.5.1 through 2026.7.0. The vulnerability is not in a browser or the Google Meet service itself; it is in the OpenClaw plugin-to-node command plumbing, and exploitation requires the specific combination of the Google Meet plugin enabled, a paired Chrome node, googlemeet.chrome present in the allowed node commands list, and an agent with tool invocation rights. The independent assessment scores this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, consistent with a network-reachable, low-complexity, low-privilege path whose scope stays within the compromised paired node.
Know when Openclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable agent runtime with an authorized-but-low-privilege caller (PR:L), no user interaction; arbitrary command execution yields full C/I/A on the paired node.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
OpenClaw versions 2026.5.1 through 2026.7.0 fail to apply the configured exec approval path to Google Meet node commands. The googlemeet.chrome command accepts caller-supplied audio command arrays and executes them on a paired node without going through the normal system.run approval flow. In deployments with the Google Meet plugin enabled, a paired Chrome node, and the googlemeet.chrome node command allowed, a tool-enabled agent able to invoke that command can execute attacker-selected processes on the paired node, impacting files, credentials, browser profiles, and availability on that node. The issue is fixed in 2026.7.1; as a workaround, remove googlemeet.chrome from allowed node commands or disable the Google Meet plugin.
Technical POC Analysis
CWE-78 (OS command injection) is the primary weakness; the advisory also tags CWE-862 (Missing Authorization) and CWE-863 (Incorrect Authorization), which is the more precise description of what actu…
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
OpenClaw deployments that pair a Chrome node and enable the Google Meet plugin in versions 2026.5.1 through 2026.7.0 allow an authenticated, tool-enabled agent to execute operating-system commands of its choosing on that paired node, bypassing the platform's normal execution-approval controls. Any organization running this configuration should treat affected Chrome nodes as exposed endpoints, since compromise carries full loss of confidentiality, integrity, and availability on the node - potentially including credentials, browser sessions, and data reachable from it. Leadership should care because the flaw undermines the governance boundary the platform relies on to gate agent-initiated actions, and remediation requires both an upgrade and a review of which agents are permitted to call node commands.
Apply vendor patch (OpenClaw 2026.7.1). Until the upgrade is verified, remove googlemeet.chrome from the allowed node commands list or disable the Google Meet plugin, which the vendor states fully mitigates the issue, and restrict node-command invocation to trusted agents.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Related Vulnerabilities in OpenClaw Approval and Exec Authorization Bypasses
View all 2Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a
Unauthenticated access to the noVNC observer interface in OpenClaw's Docker sandbox browser allows anyone who can reach
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
Exploit-DB