[Windows] Smart App Control repeatedly blocks unsigned Chrome extension-host.exe bundled with Codex Desktop

Start by tracing how the bundled MSIX supplies %USERPROFILE%.codex\plugins\cache\openai-bundled\chrome\26.715.31925\extension-host\windows\x64\extension-host.exe and review the Code Integrity Operational log for Event ID 3077. Verify the executable's Authenticode signature and the retry behavior. Done means the host is accepted by Smart App Control, or a failed launch no longer retries repeatedly and reports an actionable error.

Summary

On Windows 11 with Smart App Control enabled, Codex Desktop repeatedly launches the bundled Chrome plugin native host, but Windows Code Integrity blocks it because extension-host.exe is not Authenticode-signed.

This produces recurring “Smart App Control has blocked part of this app” notifications and Code Integrity Event ID 3077 approximately every five seconds while the Chrome plugin is installed.

Environment

• Codex Desktop (Microsoft Store): 26.715.4045.0
• Bundled Chrome plugin/cache: 26.715.31925
• Windows 11 Home x64: 10.0.26200 (Build 26200)
• Smart App Control: enabled

Reproduction

1. Install or enable the bundled Codex Chrome plugin.
2. Run Codex Desktop with the Codex browser extension present.
3. Observe the Windows Smart App Control notification.
4. Check Applications and Services Logs > Microsoft > Windows > CodeIntegrity > Operational.

Actual result

Windows records Event ID 3077 repeatedly. The blocked file is:

%USERPROFILE%\.codex\plugins\cache\openai-bundled\chrome\26.715.31925\extension-host\windows\x64\extension-host.exe

The executable does not meet the required signing level / Code Integrity policy.

Diagnostics:

• Get-AuthenticodeSignature: NotSigned
• SHA-256: 2775829D1A493E1B64A88C4EEEBAA8AC1A63E7AC0AEFD2F6412FF4C678B303EC
• The cached executable is byte-identical to the copy bundled inside the installed Codex MSIX package.
• Updating Codex through Microsoft Store completed successfully but installed the same app version and the same unsigned binary, so the issue remained.
• Uninstalling the Chrome plugin stopped the recurring Code Integrity events.

Expected result

The bundled extension-host.exe should be Authenticode-signed and compatible with Windows Smart App Control / WDAC, so that the Chrome integration can run without security warnings or repeated blocked-launch attempts.

If the host cannot start, Codex should also stop retrying every few seconds and display a clear, actionable error.

Workaround

Uninstall the Chrome plugin. The recurring Smart App Control notifications and Event ID 3077 entries then stop, but browser-extension integration is unavailable.

Related public issues

• openai/codex#32487 reports the same Smart App Control / unsigned bundled-helper problem for node_repl.exe.
• openai/codex#32706 concerns lifecycle and update problems involving the Chrome plugin's extension-host.exe.

This report is specifically about Smart App Control blocking the unsigned Chrome extension-host.exe; therefore it appears related to, but not an exact duplicate of, those issues.