Which versions of Chrome are affected by CVE-2026-22174?

CVE-2026-22174 presents moderate security risk, a missing authentication vulnerability rated CVSS 5.9. This could allow unauthorized access to protected resources.. A patch is available.

How to fix or mitigate CVE-2026-22174?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Audit authentication configurations.

Chrome CVE-2026-22174

Q: What is the CVSS score of CVE-2026-22174?

CVE-2026-22174 has a CVSS 4.0 base score of 5.9 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-12716 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-03-18 VulnCheck

GHSA-v3j7-34xh-6g3w

Authentication Bypass Google Chrome

5.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 18, 2026 - 02:30 euvd

EUVD-2026-12716

Analysis Generated

Mar 18, 2026 - 02:30 vuln.today

Patch released

Mar 18, 2026 - 02:30 nvd

Patch available

CVE Published

Mar 18, 2026 - 01:34 nvd

MEDIUM 5.9

DescriptionCVE.org

OpenClaw versions prior to 2026.2.22 inject the x-OpenClaw-relay-token header into Chrome CDP probe traffic on loopback interfaces, allowing local processes to capture the Gateway authentication token. An attacker controlling a loopback port can intercept CDP reachability probes to the /json/version endpoint and reuse the leaked token as Gateway bearer authentication.

AnalysisAI

OpenClaw Gateway versions prior to 2026.2.22 leak authentication tokens through Chrome DevTools Protocol (CDP) probe traffic on loopback interfaces, allowing local attackers to intercept the x-OpenClaw-relay-token header and reuse it for unauthorized Gateway access. An attacker with local network access or control of a loopback port can capture reachability probes to the /json/version endpoint and escalate privileges by replaying the stolen token as bearer authentication. A vendor patch is available, and this vulnerability has been documented by VulnCheck with references to the official GitHub security advisory and patch commit.

Technical ContextAI

The vulnerability exists in how OpenClaw (cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*) implements Chrome DevTools Protocol (CDP) reachability probes on loopback interfaces. Chrome CDP is a debugging protocol that communicates over localhost by design; however, OpenClaw incorrectly injects the x-OpenClaw-relay-token header—intended for Gateway authentication—into these probes rather than using a separate, probe-specific credential mechanism. This violates the principle of least privilege in credential handling and stems from CWE-306 (Missing Authentication for Critical Function), where sensitive authentication material is transmitted without appropriate protection or context-specific isolation. The root cause is a failure to distinguish between production authentication tokens and diagnostic/probe traffic, resulting in confidential tokens being exposed to any process listening on loopback ports.

RemediationAI

Upgrade OpenClaw to version 2026.2.22 or later immediately; the vendor patch is available and should be applied without delay. If immediate patching is not feasible, implement network-level mitigations by restricting loopback interface access to trusted processes only, disabling CDP probes if not required for monitoring, and monitoring /json/version endpoint access logs for suspicious patterns. Additionally, enforce token rotation policies and revoke any tokens that may have been exposed during the window of vulnerability. Implement host-level network segmentation using firewall rules to prevent unprivileged processes from binding to loopback ports that OpenClaw uses for probes. For development and container environments, use network policies and seccomp/AppArmor profiles to isolate OpenClaw processes from other local services.