What is the CVSS score of EUVD-2026-13941?

EUVD-2026-13941 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Chrome are affected by EUVD-2026-13941?

CVE-2026-32046 presents moderate security risk rated CVSS 5.3. Exploitation could compromise the security of affected deployments. Proof-of-concept code is publicly available.. A patch is available.

Is there a public PoC exploit available for EUVD-2026-13941?

Yes, a public proof-of-concept exploit is available for EUVD-2026-13941. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-13941?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Chrome EUVD-2026-13941

| CVE-2026-32046 MEDIUM

Initialization of a Resource with an Insecure Default (CWE-1188)

2026-03-21 VulnCheck

GHSA-q94v-v6m9-jhq9

RCE Chrome Google Openclaw

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

PoC Detected

Mar 24, 2026 - 19:12 vuln.today

Public exploit code

EUVD ID Assigned

Mar 21, 2026 - 01:00 euvd

EUVD-2026-13941

Analysis Generated

Mar 21, 2026 - 01:00 vuln.today

Patch released

Mar 21, 2026 - 01:00 nvd

Patch available

CVE Published

Mar 21, 2026 - 00:42 nvd

MEDIUM 5.3

DescriptionCVE.org

OpenClaw versions prior to 2026.2.21 contain an improper sandbox configuration vulnerability that allows attackers to execute arbitrary code by exploiting renderer-side vulnerabilities without requiring a sandbox escape. Attackers can leverage the disabled OS-level sandbox protections in the Chromium browser container to achieve code execution on the host system.

AnalysisAI

OpenClaw versions prior to 2026.2.21 contain an improper sandbox configuration vulnerability (CWE-1188) that allows local attackers with low privileges to execute arbitrary code on the host system by exploiting disabled OS-level sandbox protections in the Chromium browser container. The vulnerability does not require a sandbox escape, making exploitation straightforward for local users. A patch is available from the vendor, and the issue was reported by VulnCheck with references to GitHub security advisories and patch commits.

Technical ContextAI

The vulnerability stems from improper sandbox configuration in OpenClaw, which depends on Chromium's browser container isolation mechanisms. OpenClaw (cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*) fails to enforce OS-level sandbox protections at the renderer process level, allowing attackers to exploit renderer-side vulnerabilities without needing to escape the sandbox first. This is classified as CWE-1188 (Initialization with Hard-Coded Network Resource Configuration Data), though the root cause is fundamentally a failure to enforce sandbox isolation boundaries in the Chromium renderer process. The disabled sandbox protections eliminate the intended containment layer that should prevent renderer exploits from affecting the host system.

RemediationAI

Upgrade OpenClaw to version 2026.2.21 or later immediately, following the vendor security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-43x4-g22p-3hrq. For systems that cannot be patched immediately, restrict local user access through OS-level access controls, disable local user shells where feasible, and monitor process creation events for suspicious renderer-spawned activity. Implement principle of least privilege for local accounts and consider containerizing or sandboxing OpenClaw deployments with hypervisor-level isolation to compensate for the disabled Chromium sandbox until patching is completed. Verify patch deployment by checking OpenClaw version and reviewing the referenced commit hashes.