CVE-2026-11326 Overview
CVE-2026-11326 affects OpenAI Atlas versions before 1.2025.288.15. The browser exposed privileged internal APIs to web content loaded from any *.openai.com origin. A cross-site scripting (XSS) flaw in forum.openai.com allowed attackers to invoke those privileged functions from injected script. Successful exploitation granted access to browser history data and the ability to open or close tabs without user consent. OpenAI Atlas 1.2025.288.15 narrowed the exposed API surface to *.chatgpt.com origins only, removing the trust relationship that made the forum XSS reachable. The issue is categorized under [CWE-284] Improper Access Control.
Critical Impact
Attackers exploiting XSS on a trusted OpenAI subdomain can read browser history and manipulate tabs in the OpenAI Atlas browser.
Affected Products
- OpenAI Atlas browser versions prior to 1.2025.288.15
- Deployments trusting any *.openai.com origin for privileged API access
- Users visiting forum.openai.com with vulnerable Atlas builds
Discovery Timeline
- 2026-06-05 - CVE-2026-11326 published to the National Vulnerability Database
- 2026-06-05 - Last updated in NVD database
Technical Details for CVE-2026-11326
Vulnerability Analysis
OpenAI Atlas is a web browser developed by OpenAI. The product exposed a set of privileged JavaScript bindings intended for first-party integration with OpenAI web properties. These bindings allowed callers to read browser history records and to programmatically open or close tabs. Access control was enforced by origin allowlist rather than by capability or process boundary. The allowlist included the broad pattern *.openai.com, which encompasses community-driven properties such as forum.openai.com alongside hardened application origins.
The forum subdomain contained a cross-site scripting (XSS) defect. An attacker capable of triggering script execution under that origin inherited the same privileged binding access as legitimate first-party code. The defect therefore combined a client-side injection flaw with an over-scoped trust boundary, satisfying [CWE-284] Improper Access Control.
Root Cause
The root cause is the use of an overly broad origin allowlist for privileged renderer-to-browser APIs. Any subdomain of openai.com was treated as equivalent in trust to core product origins. Forum software and other content-driven properties operate under different threat models than core application code, but the access policy did not distinguish between them.
Attack Vector
Exploitation requires an attacker to deliver an XSS payload reachable from forum.openai.com and to lure an Atlas user to view the affected forum content. User interaction is required, and the attack complexity is elevated because the XSS condition must exist on a trusted origin. Once script executes in the forum origin, the payload calls the exposed privileged APIs to enumerate browser history or to open and close tabs. Network access to the victim browser is sufficient; no local code execution is needed. Refer to the Hacktron blog post on hacking OpenAI Atlas for the public technical writeup.
Detection Methods for CVE-2026-11326
Indicators of Compromise
- Atlas client builds reporting versions earlier than 1.2025.288.15 in endpoint inventory data
- Browser telemetry showing unexpected tab open or close events originating from forum.openai.com tabs
- Outbound requests from forum pages that carry browser history fragments to attacker-controlled hosts
Detection Strategies
- Inventory installed Atlas versions across managed endpoints and flag any release prior to 1.2025.288.15
- Inspect proxy and DNS logs for forum page loads correlated with anomalous data exfiltration patterns
- Hunt for browser process activity that opens or closes tabs at high frequency without user interaction signals
Monitoring Recommendations
- Track Atlas auto-update status to confirm fleet-wide rollout of 1.2025.288.15 or later
- Alert on script-initiated navigation events from *.openai.com properties other than *.chatgpt.com
- Review web application logs on internal forum platforms for stored XSS patterns as a defense-in-depth measure
How to Mitigate CVE-2026-11326
Immediate Actions Required
- Upgrade OpenAI Atlas to version 1.2025.288.15 or later on all managed and personal endpoints
- Verify that automatic updates are enabled so subsequent Atlas releases install without manual intervention
- Restrict user navigation to forum.openai.com from Atlas until the patched version is confirmed deployed
Patch Information
OpenAI fixed the issue in Atlas 1.2025.288.15 by narrowing the privileged API allowlist to *.chatgpt.com. The forum.openai.com origin and other non-application subdomains no longer inherit access to history or tab management APIs. Upgrading to 1.2025.288.15 or later remediates the vulnerability.
Workarounds
- Use an alternate browser to access forum.openai.com until Atlas is updated
- Block the forum origin at the corporate proxy for users running unpatched Atlas builds
- Disable or remove Atlas on endpoints where timely patching cannot be guaranteed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
