CVE-2026-11326: Medium severity OpenAI OpenAI Atlas vulnerability
OpenAI Atlas before 1.2025.288.15 exposed privileged browser APIs to web content on .openai.com origins. A cross-site scripting vulnerability in forum.openai.com could be used to access these functions, allowing access to browser history information and the ability to open or close tabs. OpenAI Atlas 1.2025.288.15 narrows access to these APIs to .chatgpt.com; users should upgrade to 1.2025.288.15 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenAI Atlasto a version that resolves this vulnerability.Fixed in 1.2025.288.15
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11326?
The severity of CVE-2026-11326 is medium, with a score of 6 according to the CVSS.
How do I fix CVE-2026-11326?
To fix CVE-2026-11326, you need to upgrade to OpenAI Atlas version 1.2025.288.15 or later.
What type of vulnerability is CVE-2026-11326?
CVE-2026-11326 is a cross-site scripting vulnerability affecting OpenAI Atlas.
What are the potential impacts of CVE-2026-11326?
The potential impacts of CVE-2026-11326 include unauthorized access to browser history and the ability to manipulate browser tabs.
Which software is affected by CVE-2026-11326?
CVE-2026-11326 affects the OpenAI Atlas software prior to version 1.2025.288.15.