Forever Security opened a local malicious HTML document in embedded browser surfaces used by desktop coding assistants. The reported failure is not that a hosted website had arbitrary read access, but that an embedded file origin lacked protections expected in a conventional browser. In Codex, a top-level file context could reach files outside the intended…
Inspect the ClaimsCase · DiggingBeagle record
Embedded assistant previews expose local files outside trusted project roots
Local HTML opened in desktop assistant browsers could use file-origin implementation gaps to read files outside a project directory.
Scope
A locally opened attacker-supplied HTML file and an affected embedded preview are prerequisites. The report does not establish remote exploitation of an unopened webpage or a measured population of victims.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- AI role
- AGAINST AI
Basis and provenance
Forever Security documented product-specific reads; fixed builds and actual victim populations were not established for every affected surface. Impact remains unrated because the scoped record does not establish a calibrated severity-to-impact-band mapping.
Assessed Oct 31, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-C26-EMBRACE-LOCAL-FILE-1 · EMBRACE: embedded AI-assistant browser attack paths
At a glance
The tested local file and context are prerequisites; a remote arbitrary website was not shown to read every file automatically.
Read the implicationsPrecise fixed builds for every tested assistant and worker context are not established for every vendor. The number of actual installations that loaded malicious HTML is unknown.
Limits and uncertaintyFull account
Forever Security opened a local malicious HTML document in embedded browser surfaces used by desktop coding assistants. The reported failure is not that a hosted website had arbitrary read access, but that an embedded file origin lacked protections expected in a conventional browser. In Codex, a top-level file context could reach files outside the intended root. In Claude Desktop and VS Code browser previews, worker or subordinate contexts were used to cross related restrictions. File discovery helped locate potential secrets, but access depended on launching the local document in an affected preview.
The observed reads were controlled demonstrations. A reproduction should distinguish the local file scheme, top-level document, worker execution, project boundary, and whether any exfiltration sink was actually reached. Separate product fixes and builds matter; a single generic “browser is vulnerable” label would hide these differences.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Timeline
- Oct 29, 2026disclosure
Public disclosure
Claims & evidence
CLM-C26-EMBRACE-LOCAL-FILE-1Forever Security reproduced reads of out-of-project local material through file-origin handling in several embedded assistant browsers under product-specific conditions.supported
Basis: reported finding
- supportsEMBRACE: embedded AI-assistant browser attack pathsprimary disclosure
EMBRACE technical article, local file exposure and embedded file:// browser origins
Implications
The tested local file and context are prerequisites; a remote arbitrary website was not shown to read every file automatically.
Controls and mitigations
- Constrain file-scheme capabilities per top-level document, subframe and worker, and validate read and outbound boundaries separately on each assistant.
Unknowns and contradictions
- Precise fixed builds for every tested assistant and worker context are not established for every vendor.
- The number of actual installations that loaded malicious HTML is unknown.
Sources and citation
Material revision history
- Oct 31, 2026 · Canonical change recorded · new in release · revision 208