OpenAI Atlas before 1.2025.288.15 exposed privileged browser APIs to web content on *.openai.com origins. A cross-site scripting vulnerability in forum.openai.com could be used to access these functions, allowing access to browser history information and the ability to open or close tabs. OpenAI Atlas 1.2025.288.15 narrows access to these APIs to *.chatgpt.com; users should upgrade to 1.2025.288.15 or later.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Openai |
|
No data.
No data.
References
| Link | Providers |
|---|---|
| https://www.hacktron.ai/blog/hacking-openai-atlas-browser |
|
History
Fri, 05 Jun 2026 10:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Openai
Openai openai Atlas |
|
| Vendors & Products |
Openai
Openai openai Atlas |
Fri, 05 Jun 2026 05:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Cross‑Site Scripting Allowing Browser History Access and Tab Control in OpenAI Atlas |
Fri, 05 Jun 2026 01:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | OpenAI Atlas before 1.2025.288.15 exposed privileged browser APIs to web content on *.openai.com origins. A cross-site scripting vulnerability in forum.openai.com could be used to access these functions, allowing access to browser history information and the ability to open or close tabs. OpenAI Atlas 1.2025.288.15 narrows access to these APIs to *.chatgpt.com; users should upgrade to 1.2025.288.15 or later. | |
| Weaknesses | CWE-284 | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: OAI
Published: 2026-06-05T00:12:32.077Z
Updated: 2026-06-05T00:12:32.077Z
Reserved: 2026-06-05T00:07:13.696Z
Link: CVE-2026-11326
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-06-05T02:17:11.180
Modified: 2026-06-05T14:59:31.207
Link: CVE-2026-11326
Redhat
No data.