Embedded browsers in five AI coding assistants allow code execution, file theft and address spoofing

Forever Security's EMBRACE research describes separate flaws sharing one design problem: embedded browsers trusted like real ones. In Cursor, the window.cursorBrowser.send() bridge let any loaded page push content into the agent's input without a user gesture, and hidden HTML attributes could assemble an npm install command that ran a preinstall script. Success depended on the model. Copilot accepted page-supplied address updates without checking them, and was fixed in 1.1.29 after confirmation in 1.1.27. Claude Desktop and VS Code did not apply file restrictions inside web workers, and Codex local pages could fetch files directly. No CVE IDs are given. Cursor patched on 1 October. Codex and VS Code were unpatched at publication, and Anthropic's patch status is unclear. Treat opening untrusted local previews as risky.

For security analysts · Written by AI from 2 sources · Wrong?