{"data":{"id":"433443d0-9c95-4554-80a5-b0ad00f2e9f0","title":"CVE-2026-11326: OpenAI Atlas before 1.2025.288.15 exposed privileged browser APIs to web content on *.openai.com origins. A cross-site…","summary":"OpenAI Atlas before 1.2025.288.15 exposed privileged browser APIs to web content on *.openai.com origins. A cross-site scripting vulnerability in forum.openai.com could reach these functions, allowing access to browser history and the ability to open or close tabs. The weakness is classified as CWE-284, Improper Access Control.","solution":"OpenAI Atlas 1.2025.288.15 narrows access to these APIs to *.chatgpt.com; users should upgrade to 1.2025.288.15 or later.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-11326","publishedAt":"2026-06-05T02:17:11.180Z","cveId":"CVE-2026-11326","cweIds":["CWE-284"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["OpenAI"],"affectedVendorsRaw":["OpenAI Atlas","ChatGPT","forum.openai.com"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"OpenAI Atlas cross-site scripting exposes privileged browser APIs","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00214,"epssCheckedAt":"2026-11-05T00:11:44.028Z","kevDateAdded":null,"advisoryAliases":["GHSA-x355-jg5j-p4h6"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-03T00:09:42.569Z","patchAvailable":null,"disclosureDate":"2026-06-05T02:17:11.180Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[]}}