Executive brief
OpenAI Atlas, an AI-powered web browser, contained a security flaw that allowed malicious websites to take control of the browser's internal functions. By exploiting a vulnerability on an OpenAI forum page, an attacker could track a user's browsing history, open or close tabs without permission, and steal login tokens for sensitive accounts like GitHub or Facebook. This could lead to full account takeovers of any service the user visits within the Atlas browser.
Technical details
OpenAI Atlas improperly exposed Mojo IPC (Inter-Process Communication) bindings to a broad allowlist of domains, including *.openai.com. A DOM-based XSS vulnerability was identified in forum.openai.com via an unsanitized postMessage listener for the 'pushUrl' action. By chaining this XSS with the exposed Mojo interfaces (specifically the 'kaur1br5' toolset), an attacker could bypass the Same-Origin Policy (SOP). This allows for Universal XSS (UXSS) capabilities, including monitoring navigation URLs in real-time, intercepting OAuth authorization codes, and manipulating browser tabs. The issue was resolved in version 1.2025.288.15 by restricting privileged API access to *.chatgpt.com.
Affected products
- OpenAI Atlas before 1.2025.288.15
Timeline
- 2025-12-02: disclosed: Initial research published by Hacktron AI
- 2026-06-05: advisory: CVE published to NVD