Skip to content

VS Code and Codex still haven't patched an embedded-browser bug

Forever Security's EMBRACE research found Cursor, GitHub Copilot, Claude Desktop, VS Code and Codex all gave their embedded browsers powers a real browser would block. Cursor and Copilot are fixed; the other three are not.

Source: Forever Security

Forever Security disclosed a class of bugs it calls EMBRACE on 29 October, found in the built-in browsers that Cursor, GitHub Copilot, Claude Desktop, VS Code and Codex use to preview pages and hand control to their AI agents. Researcher Gal Weizman found each tool gave its embedded browser powers a normal browser withholds, breaking the usual trust boundary a different way in each: Cursor let a malicious page’s hidden HTML feed commands straight to its agent, which ran them with full system privileges. GitHub Copilot could be tricked into showing a fake address for the page it had actually loaded. Claude Desktop, VS Code and Codex could all be made, from a single local HTML file, to read files well outside the current project, including SSH keys and credentials.

Cursor fixed its bug silently on 1 October, after disclosure on 10 September, without publishing an advisory. GitHub independently patched Copilot’s spoofing flaw, found in build 1.1.27, in build 1.1.29 on 13 October. Anthropic declined the Claude Desktop report, filed on 23 July, saying the behaviour sits outside its “workspace trust” security boundary. OpenAI and Microsoft have not patched Codex or VS Code as of publication.

Why it matters: if you use VS Code’s or Codex’s built-in browser preview, treat any local HTML file you didn’t write yourself as untrusted until a fix ships, since opening one can leak files far outside your project folder. None of the five bugs carries a CVE, so there’s nothing to track in a scanner, only each vendor’s own response, or lack of one.

Share

Related reading

Engineering

How to patch PHP in a hurry without breaking production

PHP ships an out-of-band fix for two critical flaws at 14:00 UTC today. Here is the hour of preparation that turns the patch into a non-event, and the runbook for when it lands.

ML for Web Devs

Tokens, context windows, and why your bill is what it is

The unit of billing for language models is not the request or the word. Once you understand tokens and how a context window fills up, the invoice stops being a surprise.

ML for Web Devs

RAG is just search with extra steps

Retrieval-augmented generation gets written up like an architecture. It is a search query, a string concatenation and one API call, and the search query is the part that decides whether it works.

More from The Wire

All briefs