Embedded browsers in five AI coding assistants allow code execution, file theft and address spoofing
- Severity
- High
- Sources
- 2
What happened
Forever Security's EMBRACE research describes separate flaws sharing one design problem: embedded browsers trusted like real ones. In Cursor, the window.cursorBrowser.send() bridge let any loaded page push content into the agent's input without a user gesture, and hidden HTML attributes could assemble an npm install command that ran a preinstall script. Success depended on the model. Copilot accepted page-supplied address updates without checking them, and was fixed in 1.1.29 after confirmation in 1.1.27. Claude Desktop and VS Code did not apply file restrictions inside web workers, and Codex local pages could fetch files directly. No CVE IDs are given. Cursor patched on 1 October. Codex and VS Code were unpatched at publication, and Anthropic's patch status is unclear. Treat opening untrusted local previews as risky.
For security analysts · Written by AI from 2 sources · Wrong?
What to do
- Check whether you use the affected product, and install the vendor’s fix when it is available. Open your watchlist
General advice for this kind of story
Full story timeline · 2 updates
Who reported · 2 outlets
Who and what is in it
Products