EMBRACE: embedded AI-assistant browser attack paths

Evidence record

Forever Security reports local-file exposure, privileged browser bridge message spoofing and an origin display spoof across several desktop assistants; conditions differ by product.

Read the original source ↗

Claim-level citations (3)

• supportsCopilot desktop preview could forge its displayed web origin: Forever Security demonstrated a GitHub Copilot desktop preview event that changed the displayed origin without navigating, and reported version 1.1.29 as fixed.

  EMBRACE technical article, GitHub Copilot plugin:browser-preview URL-change demonstration and October 13 fix note

• supportsCursor browser bridge turned selected page attributes into an agent command path: The researchers demonstrated that Cursor’s embedded browser could pass attacker-controlled selected-element attributes into the agent composer, influencing installation actions.

  EMBRACE technical article, Cursor window.cursorBrowser.send and element-selected bridge demonstration

• supportsEmbedded assistant previews expose local files outside trusted project roots: Forever Security reproduced reads of out-of-project local material through file-origin handling in several embedded assistant browsers under product-specific conditions.

  EMBRACE technical article, local file exposure and embedded file:// browser origins