CVEvulnerability

CVE-2026-11326

6.0 MEDIUM Published 2026-06-05 Modified 2026-07-23 Official page ↗
Status
Deferred
Published
2026-06-05
Last modified
2026-07-23
Assigner
8f4f43ab-ba69-4d92-aa1d-d772184d6fb7
CVSS 4.0 (8f4f43ab-ba69-4d92-aa1d-d772184d6fb7)
6.0 MEDIUM — CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:L/U:Green
Weaknesses
CWE-284

Description

OpenAI Atlas before 1.2025.288.15 exposed privileged browser APIs to web content on *.openai.com origins. A cross-site scripting vulnerability in forum.openai.com could be used to access these functions, allowing access to browser history information and the ability to open or close tabs. OpenAI Atlas 1.2025.288.15 narrows access to these APIs to *.chatgpt.com; users should upgrade to 1.2025.288.15 or later.

Related

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References